What NPM should do to stop a new colors attack

Re:What NPM should do to stop a new colors attack by diogenesjunior on Monday January 10, 2022 @04:31PM (#29882900)

when i have any code that requires dependencies, i always use an exact version. i am mainly a python developer, so my requirements.txt would look like this:

    flask==1.1.1
    request=2.3.2
    tensorflow==3.4.2

i tested/built my code with these versions, so i know that these versions work. when i install my dependencies, i use these versions, not the latest version. is there a way to do this with node.js? and wouldn't using this method solve any problems? pardon me if i'm missing something

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by rronalddas on Monday January 10, 2022 @04:35PM (#29882960)

Yeah, it can be done easily using lockfiles, both yarn and npm allow that. You would seldom run npm update directly in production without testing the updated deps first

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by cjpearson on Monday January 10, 2022 @05:17PM (#29883584)

Yes, if you put exact versions in your package.json and do not prefix them with a caret or tilde, npm will install the exact version. A package-lock.json version will also pin your transitive dependencies to a specific version. Unfortunately, the default behavior of npm is to add a caret to the version number which npm interprets as this version or any greater minor/patch release.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by tln on Monday January 10, 2022 @05:38PM (#29883897)

Yes, you can specify an exact version in package.json. The easiest way is by adding "-E" when installing:

    npm install chalk -ES
    yarn add chalk -ES

The -S installs and saves to package.json (equiv to requirements.txt).

That results in:

   "dependencies": {
       "chalk": "5.0.0"
   }

which is an exact dependency. By default npm and yarn use "^5.0.0" which means minor upgrades are allowed (5.x.x).

[ Parent | on HN ]