Re:Node2Shell evolves to HTTP2Shell, blast radius affects ma...
by saltcured on Sunday October 25, 2026 @01:17PM
(#50233794)
Yes, that's why I left wiggle room for a few choice packages you track yourself.
What isn't really tenable for a small team is to drag in scores to hundreds of different third-party packages and rely on them all when you have no staff allocated to really evaluate and monitor so much upstream stuff.
Basically once you leave the realm of the 5-10 most popular building blocks in an area (which OS packagers do distribute), you're still left with plenty of packages that have 10ks+ of users, sane maintainer/security/ownership models, and code that would be very difficult to just copy-paste a la stackoverflow (e.g. native/compiled deps with complex wheel build tooling).