2 ms·
> and trust that NPM at least gets their "you can't republish to an old version" bare-minimum constraint right? ... Does NPM not create full lockfiles, with ha
by zahlman 6mo ago
> and trust that NPM at least gets their "you can't republish to an old version" bare-minimum constraint right?
... Does NPM not create full lockfiles, with hashes and pinned transitive dependencies and everything?
- btown 6mo agoYes, and the problem here is that most projects have automated systems that automatically update those lockfiles on every upstream release of a library, under an assumption that minor releases are either security patches or bugfixes that would immediately be useful to the consuming project. IMO this is built on a pre-ShaiHulud, pre-AI set of assumptions, and should be evaluated from first principles with today's security situation.
- zahlman 6mo agoMy point was the "with hashes" part. You aren't in fact "trusting" NPM to ensure that old versions aren't replaced if the package installer is verifying the hash.
- esafak 6mo agohttps://docs.npmjs.com/cli/v11/configuring-npm/package-lock-json https://docs.npmjs.com/cli/v11/configuring-npm/package-lock-...