News for hackers. Stuff that matters.

A comment on Will Bun JavaScript Take Node's Crown. Parent comment

Re:Will Bun JavaScript Take Node's Crown by Supermancho on Sunday August 14, 2022 @12:59PM (#32460825)
> And it doesn't address the semver malware injection bug demonstrated by colors author

[Not a fan of Bun] In Bun, you can pin versions with package.json just like in node.js

What would address the malware injection when someone chooses to auto-update packages as part of a build?

[ Parent | on HN ]
Re:Will Bun JavaScript Take Node's Crown by Bolkan on Sunday August 14, 2022 @03:09PM (#32461986)
You can only pin your direct deps.
[ Parent | on HN ]
Re:Will Bun JavaScript Take Node's Crown by leodriesch on Sunday August 14, 2022 @05:09PM (#32462955)
A lockfile is a way to lock your indirect dependencies. If you only install based on the lockfile every dependency is pinned.
[ Parent | on HN ]
Re:Will Bun JavaScript Take Node's Crown by Bolkan on Sunday August 14, 2022 @06:02PM (#32463404)
You cannot audit and pin all your transitive dependencies. The amount of churn tge lockfile goes through is insane.
[ Parent | on HN ]
Re:Will Bun JavaScript Take Node's Crown by WorldMaker on Monday August 15, 2022 @01:10PM (#32472389)
Dependabot watches all the transitive dependencies in your lock files. For better and worse. For worse in that it's not a great developer experience to get a PR on a low level transitive dependencies, which is also one of the largest complaints about Dependabot that it often feels too low level and not working at the dependency level you are working at. But Dependabot (and npm audit) still exist to audit all your low level transitive dependencies in your lock files.
[ Parent | on HN ]