search

webdev03 / scratch-spam

Scratch spam detection
MIT License
1 stars 3 forks source link

Take measures to avoid `Marak/colors.js` incident #4

Closed hello-smile6 closed 2 years ago

hello-smile6 commented 2 years ago

You might want to fork all of the dependencies and use your copy of each one, just to be safe, or at least fork the packages that have non-explicit versions. @webdev03

webdev03 commented 2 years ago

Are you saying I should commit my node_modules?

hello-smile6 commented 2 years ago

Are you saying I should commit my node_modules?

No, I think you should only npm install from webdev03/* repositories, when possible.

webdev03 commented 2 years ago

Dependencies of dependencies of dependencies of dependencies

hello-smile6 commented 2 years ago

Dependencies of dependencies of dependencies of dependencies

Still would be worth it. As a proof-of-concept, I'll fork node-fetch and its dependencies.

webdev03 commented 2 years ago

I don't really care that much about dependencies.

webdev03 commented 2 years ago

If they are gone, I have a backup with pnpm.

hello-smile6 commented 2 years ago

If they are gone, I have a backup with pnpm.

Okay. Just set explicit versions and commit your lockfile. (Don't commit to a mental facility, silly. Commit it to your repository! ) 🤣 🚀