Hacker News Reader

Who really audits every single dependency in their dependency tree? not so much a rogue developer, but most.

If you are hobby programming, then not really, but in most workplaces, dependencies are usually pinned and not updated until necessary(bug fixes mostly).

From what I've seen as a contractor usually there is no package-lock at all.

Reply on news.ycombinator.com