What NPM should do to stop a new colors attack

Re:What NPM should do to stop a new colors attack by cesarb on Monday January 10, 2022 @07:08PM (#29885090)

> "Everything" in the Java world needs log4j updates, but some dependecy's dependencies pull in some specific version. There you need the way to say "get the new version from 5 minutes ago" without waiting for all levels of the dependency hierachy.

At least with Maven, that's extremely simple. Just add to your project a dependency on that "new version from 5 minutes ago" of log4j. Maven always prefers the version from a direct dependency. You don't have to wait for "all levels of the dependency hierarchy" at all.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by kristjansson on Monday January 10, 2022 @11:41PM (#29887638)

The problem is that, AIUI, each NPM package installs its own, isolated set of dependencies. It has facilities to manage versions down in the dep tree, but it’s not as simple as other managers which ultimately install a single set of packages that satisfy all version constraints.

[ Parent | on HN ]

Re:What NPM should do to stop a new colors attack by johannes1234321 on Tuesday January 11, 2022 @09:12AM (#29891622)

many java jars contain other jars withbthe dependency, so users don't have to run maven or something like thst, but jsut grab the jar. This is even worse. (there was no package manager early on, thus many java developers aren't taught that way, even decades after Maven was created ... and for end-user products it makes sense to bundle)

[ Parent | on HN ]