3 ms·

Wait, you're telling me that node deps are not pin by default. Every time you run your code you might be pulling in a new version. No wonder...

• hombre_fatal 6mo ago
  Node deps are pinned: https://docs.npmjs.com/cli/v8/configuring-npm/package-lock-json https://docs.npmjs.com/cli/v8/configuring-npm/package-lock-j... The problem is that you also want to update deps.
  • bfivyvysj 6mo ago
    Why?
    • NetMageSCW 6mo ago
      Because they could have a security flaw that might compromise your project or any users of it.
      • vablings 6mo ago
        For any of my rust projects I really don't bump my deps unless dependabot shows a serious vulnerability or I want to use a new feature added. Outside of that my deps are locked to the last known good version i use.