31–40 of 69 posts
With the help of AI, i see no reason to install most deps nowadays besides types and react and mui framework. Everything can be built from scratch quickly.
As someotherguyy already mentioned, this is a default feature in pnpm. And as far as cat-and-mouse-games go in other package managers, I'd say that pinning dependencies and disabling postinstall scripts is a much better option. Sure, not a foolproof one either, but as good as it gets. edit: misspelled someotherguyy's user name
Related to that is the proposal for `stabilityDays`, which seems way more practical: https://github.com/npm/cli/issues/8570#issuecomment-33004136.... So rather than merely saying "I only want package versions more than N days old", you'd be adding the requirement that "...and also they should have gone at least N days without a subsequent patch release". e.g. if mylib@6.0.0 is released, only to be quickly followed by 6.0.1 and 6.0.2, you ideally wouldn't want to risk ever installing the probably-broken 6.0.0 or 6.0.1 based on luck of the draw; the better behavior would be to stick with the last 5.x release until 6.0.2 has aged past the threshold.
Its the opposite of "keep your software up to date"
Earlier quoted context omitted.
Why is the community persisting with such poor solutions?
What would be a better solution? Do other package managers reliably restrict access to the host system beyond the scope of the project folder? Many quirks come from abilities that were once deemed useful, such as compiling code in other languages after package install. Sure, today, I can disable install scripts if I want but it doesn't change much when I eventually run code from the package anyway. But even restricti…
This works only if there are some other people, who will use a dependency "too early" to fall victim to some exploit and then notice it, within those 90 days. Imagine, if everyone only used packages older than 90 days. Then we would have no frontrunner to run into the issues before us. A cooldown time alone is not actually a sufficient solution. What people really need to stop doing, is not properly pinning their ver…
"Here, install my new 1-day old NPM package that doesn't let you install packages younger than 90 days." Pardon me, I couldn’t help myself :D
> Installs the newest "aged" version
Probably want to install version that has CVE-fixed instead, i.e find the cve for packages and install latest version that has all of them fixed but not later.
Technically someone could fake a cve to get people to upgrade but that's a far more involved process
Why does elapsed time mean a library is safe? This is so ridiculous. It doesn't protect you against anything. I'm sure there are 1000s of old libraries out there with hidden vulnerabilities or malicious code.
With the help of AI, i see no reason to install most deps nowadays besides types and react and mui framework. Everything can be built from scratch quickly.