News for hackers. Stuff that matters.

A comment on NPM package ‘ua-parser-JS’ with more than 7M weekly download is compromised. Parent comment

Re:NPM package ‘ua-parser-JS’ with more than 7M weekly downl... by arp242 on Saturday October 23, 2021 @01:06AM (#28965905)
> Now we have changes that literally affect the entire application and require significant regression testing (automated and manual) because the risk surface is so much larger. This wouldn't have happened if we didn't use a lock file with pinned versions.

But without a lock file you would always be using the latest version, right?

Wouldn't those two years of constant possible breaking updates (would you know if something updates to the latest version? How do you manage that all versions are the same across all machines?) require a lot more regression testing over those entire two years and introduce a lot more risk of breakage?

[ Parent | on HN ]
Re:NPM package ‘ua-parser-JS’ with more than 7M weekly downl... by Osiris on Saturday October 23, 2021 @05:00AM (#28966807)
No, because the changes would have been many small incremental changes, each of which is easier to validate on it's own. It's the sun of those dozens of update all at once that creates the problem.
[ Parent | on HN ]