Comment on Why is the Node ecosystem so demanding?
nick@campfyre.nickwebster.dev 1 year agoYou don’t need to do anything when you get a security advisory if you’re not impacted or the risk is acceptable. They’re just there to advise you.
Comment on Why is the Node ecosystem so demanding?
nick@campfyre.nickwebster.dev 1 year agoYou don’t need to do anything when you get a security advisory if you’re not impacted or the risk is acceptable. They’re just there to advise you.
atheken@programming.dev 1 year ago
The problem is that when you are alerted for trivial/non-actionable stuff it contributes to “alert-fatigue” and you just start ignoring all of the alerts.
As far as I’m aware, there’s also no way to triage an alert from an install other than to upgrade the offending package, which means you can’t really discriminate on the basis of “acceptable risk”