2 ms·
I worked at a place that required vendoring dependencies and had to be code reviewed just like it was your own. In fact, we were responsible for fixing any bugs
by withinboredom 2y ago
I worked at a place that required vendoring dependencies and had to be code reviewed just like it was your own. In fact, we were responsible for fixing any bugs in them ourselves. Sometimes this was just a matter of opening an issue, sometimes it required backporting the fix to our version, and sometimes it meant we took over a fork because the dependency was no longer maintained.
There were too many cases where I looked at the PR preview to do my own code review and decided to just write it myself. There is a ton of shitty code out there. More than you'd expect.
- db48x 2y agoThat is the only sensible way, in the end. Ultimately you have to fix the bug in your product, even if the bug comes from a library. Users won’t generally like to hear you make excuses of that kind.
- BobbyTables2 2y agoI’m amazed at the “big name” open source projects that effectively accept PR requests without review nor testing. Open-source feels like a cheap buffet at times…
- dartos 2y agoI mean… you still pay at a cheap buffet.
- bigfatkitten 2y agoYou're either paying at the counter or you're paying in the bathroom.
- kidneystereotyp 2y ago[dead]
- dartos 2y agoAt a cheap buffet, probably both