4 ms·

React has indeed large and thriving community. But personally, I don't understand their roadmap. It was smart decision to open the framework in the early days,

React has indeed large and thriving community. But personally, I don't understand their roadmap. It was smart decision to open the framework in the early days, but for enterprise we need more control with what's installed. E.g. with vanilla NextJS install I counted over 200 node packages, who have checked if those packages do not have security issues? We have a shortlist, we are looking at React (with tight control what is installed as additional packages), Angular (we don't have much experience with this framework in house), Oracle JET (JQuery + knockout.js), SAPUI (also JQuery), but the last two frameworks do not have large community, which could possibly mean that in case of issues we are all by ourselves.

sbarre 3y ago
> who have checked if those packages do not have security issues? There are several companies that provide this service. Socket.dev being the one that we use in the company where I work. We also make use of GitHub Advanced Security and Dependency Bot. Supply chain security is a problem for any language where your developers rely on third party packages, but agreed that it's particularly challenging with the JS ecosystem.