4 ms·
I find it strange. Github says 99% of the code is Go and 1% Makefile. Yet I see a package.json and a yarn.lock. I am not sure to which degree this relies on the
by zelphirkalt 3y ago
I find it strange. Github says 99% of the code is Go and 1% Makefile. Yet I see a package.json and a yarn.lock. I am not sure to which degree this relies on the NPM ecosystem. Probably I wouldn't want to use it for secrets, if it uses NPM ecosystem in any runtime processes. Perhaps the NPM stuff is merely for development utils?
- pdpi 3y agoThe project seems to use DocToc to generate the table of contents, and that's what that package.json is in there for. Precisely because of the issues with the NPM ecosystem, it's good that they made sure to add the lockfile.
- djbusby 3y agoLooks like those deps are for doctoc
- amingilani 3y agoThe lockfile mitigates supply chain attacks to a large extent. Much like any other language’s package ecosystem.