5 ms·

Isn't that what lockfiles are for? By default `npm i` downloads exactly the versions specified in your lockfile, and only resolves the latest versions matching

by brw 1y ago

Isn't that what lockfiles are for? By default `npm i` downloads exactly the versions specified in your lockfile, and only resolves the latest versions matching the ranges specified in package.json if no lockfile exists. But CI/CD pipelines should definitely be using `npm ci` instead, which will only install packages from a lockfile and throws an error if it doesn't exist.

touristtam 1y ago
That and pin that damn version!
- AndreasHae 1y ago
  It’s still ridiculous to me that version pinning isn’t the default for npm. The first thing I do for all of my projects is adding a .npmrc with save-exact=true
  - silverwind 1y ago
    save-exact is mostly useless against such attacks because it only works on direct dependencies.
    - electrotype 1y ago
      Why, though?