3 ms·
Pnpm has a new setting to stave off supply chain attacks https://news.ycombinator.com/item?id=45286526 https://news.ycombinator.com/item?id=45286526 yarn feat
by latchkey 1y ago
Pnpm has a new setting to stave off supply chain attacks
https://news.ycombinator.com/item?id=45286526 https://news.ycombinator.com/item?id=45286526
yarn feat: implement npmMinimumReleaseAge and npmMinimumReleaseAgeExclude config options
https://github.com/yarnpkg/berry/pull/6901 https://github.com/yarnpkg/berry/pull/6901
- shadowgovt 1y agoFundamentally, the fix isn't technical; it's social / structural. Companies either hold themselves accountable for signing off on the dependencies they use, hold the repos accountable for signing off the dependencies, or keep doing what we've been doing. The third option is amortized cheapest.
- cluckindan 1y agoIt’s not great. If an urgent security patch needs to be applied, the package must be excluded entirely from the minimum age requirement. There is no way to allow just a single version.