6 ms·
changelogs, but not the code?
by bugtodiffer 1y ago
changelogs, but not the code?
- bravesoul2 1y agoThat's a judgement call. It would be too much to review all code change of all dependencies unfortunately. The corollary of reviewing all code on all dependency updates is you should review all code or the new deps you add, including the transformation by build processes that might mean what is in the package manager might be different and same for all transitive dependencies. Same with the language and runtime tooling. It is too hard to be perfect!