3 ms·
How does this lock down transitive dependencies? Is it effective if the action you rely on doesn't pin its dependencies?
by g947o 10mo ago
How does this lock down transitive dependencies? Is it effective if the action you rely on doesn't pin its dependencies?
- baobun 10mo agoYou don't use actions pulling in unpinned dependencies outside of trusted distro package manager at runtime. I believe this problem is probably overstated. Can you point us to such an action you are concerned with that has either transitive actions dependency or unlocked npm dependencies where maintainers aren't responsive to addressing PRs to illustrate?