3 ms·
Is it possible to fix it in a backwards compatible way? Removing lifecycle scripts is at least a semver major change, and would complicate existing projects rel
by sheept 4mo ago
Is it possible to fix it in a backwards compatible way? Removing lifecycle scripts is at least a semver major change, and would complicate existing projects relying on packages with lifecycle scripts from upgrading.
- evilduck 4mo agoThis is a real world trolley problem scenario. You can break workflows or you can let everyone get pwned by supply chain attacks. Which is the greater harm?
- sheept 4mo agoPeople will not adopt a safer version if it broke their workflows. Adoption is part of preventing supply chain attacks.
- idiotsecant 4mo agoThey will if it's the only version. Eventually.
- evilduck 4mo agoSure they will. When the real or perceived cost of addressing supply chain attacks exceeds the cost of changing tooling workflows, they will switch.