Comment on Why is the Node ecosystem so demanding?
nick@campfyre.nickwebster.dev 10 months agoYou don’t need to do anything when you get a security advisory if you’re not impacted or the risk is acceptable. They’re just there to advise you.
Comment on Why is the Node ecosystem so demanding?
nick@campfyre.nickwebster.dev 10 months agoYou don’t need to do anything when you get a security advisory if you’re not impacted or the risk is acceptable. They’re just there to advise you.
atheken@programming.dev 10 months ago
The problem is that when you are alerted for trivial/non-actionable stuff it contributes to “alert-fatigue” and you just start ignoring all of the alerts.
As far as I’m aware, there’s also no way to triage an alert from an install other than to upgrade the offending package, which means you can’t really discriminate on the basis of “acceptable risk”