3 ms·
The problem with this approach is not shipping unused functions at the end. Pruning them is an old practice. The problem is inclusion of that much libraries cr
by bayindirh 2y ago
The problem with this approach is not shipping unused functions at the end. Pruning them is an old practice.
The problem is inclusion of that much libraries creates a dependency hell, because a higher level library pulls in approximately 5 more libraries which are generally shared amongst other libraries you potentially pull.
Library A updates its' dependency to library C to a new, more recent minimum, but library B depends on C's behavior which is recently changed. Hence A requires C > v3, but B requires C==v2. Then the fun begins.
Bonus points for having a serious CVE/RCE as a reason for updating C to v3 in the first place.
- throwaway11460 2y agoThat's why we use Semver, at least in the Node land. A security fix should be a patch, at most minor version bump - API/behavior shouldn't change.
- bayindirh 2y agoThis doesn't change the fact that some security fixes forces behavioral changes, and semver doesn't protect you against that. You fix the bug, and the behavior changes, because your design was wrong in the first place. Now there is at least one library which depends on that behavior so bad, so they can't change their dependency chain in two days.