3 ms·
? Package lock files from npm/yarn/pnpm automatically lock all your dependencies (including transitive deps) What does this actually achieve?
by madeofpalk 1y ago
? Package lock files from npm/yarn/pnpm automatically lock all your dependencies (including transitive deps)
What does this actually achieve?
- user34283 1y agoMaybe the same as if "npm config set save-exact true" was enabled when adding the dependencies. Whether that's so important, I'm not sure.
- apimade 1y agoAccidentally installing a malicious package in your dev environment, the concern isn’t “what’s already installed”, it’s what’s potentially going to be installed in the future by you or your colleagues. So, you pin the version and update periodically when security issues arise in your dependencies.