7 ms·
You can only pin your direct deps.
by Bolkan 4y ago
You can only pin your direct deps.
- leodriesch 4y agoA lockfile is a way to lock your indirect dependencies. If you only install based on the lockfile every dependency is pinned.
- Bolkan 4y agoYou cannot audit and pin all your transitive dependencies. The amount of churn tge lockfile goes through is insane.
- deleted 4y ago[deleted]
- WorldMaker 4y agoDependabot watches all the transitive dependencies in your lock files. For better and worse. For worse in that it's not a great developer experience to get a PR on a low level transitive dependencies, which is also one of the largest complaints about Dependabot that it often feels too low level and not working at the dependency level you are working at. But Dependabot (and npm audit) still exist to audit all your low level transitive dependencies in your lock files.