> As soon as you are no longer implicitly trusting all future versions of your d... | Hacker News

Hacker Newsnew | past | comments | ask | show | jobs | submit

Zababa on Nov 15, 2021 | parent | context | favorite | on: From zero to hero: contributing to open source (20...

> As soon as you are no longer implicitly trusting all future versions of your dependencies, things become much more sane.

I agree, I wish npm ci and fixed dependencies were the default, but they're not and people need to learn about them.

remram on Nov 15, 2021 [–]

Lock files are not enough, you can't review all the dependencies yourself every time you lock. A new tool is needed to deal with trust.

Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4
Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact