3 ms·
The package-lock.json includes a hash of the package, not just a version number which should be immutable.
by vel0city 1y ago
The package-lock.json includes a hash of the package, not just a version number which should be immutable.
- whilenot-dev 1y agoTo add to this: the hash in the lock file is the checksum of the published tarball, not the commit hash.
- cluckindan 1y agoAnd then someone runs `npm install` on their CI