News for hackers. Stuff that matters.
Re:What NPM should do to stop a new colors attack by tln on Monday January 10, 2022 @05:38PM (#29883897)
Yes, you can specify an exact version in package.json. The easiest way is by adding "-E" when installing:

    npm install chalk -ES
    yarn add chalk -ES
The -S installs and saves to package.json (equiv to requirements.txt).

That results in:

   "dependencies": {
       "chalk": "5.0.0"
   }
which is an exact dependency. By default npm and yarn use "^5.0.0" which means minor upgrades are allowed (5.x.x).

There are no comments on this comment yet.