News for hackers. Stuff that matters.

A comment on Security alerts on GitHub. Parent comment

Re:Security alerts on GitHub by caffed on Thursday November 16, 2017 @03:56PM (#15716547)
I am thinking that it's because the React package.json does not have `repository` listed.

https://github.com/facebook/react/blob/master/package.json

See Redux: https://github.com/reactjs/redux/blob/master/package.json#L3...

[ Parent | on HN ]
Re:Security alerts on GitHub by wereHamster on Thursday November 16, 2017 @04:03PM (#15716594)
Let's be honest, unless you use a private NPM registry, "react" means https://www.npmjs.com/package/react. GitHub should use the standard resolution algorithm as employed by npm/yarn (the CLI tools).
[ Parent | on HN ]
Re:Security alerts on GitHub by couchand on Thursday November 16, 2017 @06:27PM (#15717643)
That's not the package.json that gets published in the npm react package. This one is what you're looking for:

https://github.com/facebook/react/blob/master/packages/react...

[ Parent | on HN ]