-
|
There is a problem to avoid malicious code in libraries. There is a case when we have a concrete version of lib in package.json. but the same lib in yarn.lock has subdependence with caret. How to avoid caret and tilda in subdependencies of yarn.lock? Thanks |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
It depends on the authors of those libraries to choose the dependency versions. You could modify them with packageExtensions but in the long term that’s not going to be extremely viable as you add more dependencies. |
Beta Was this translation helpful? Give feedback.
-
|
@RDIL thx |
Beta Was this translation helpful? Give feedback.
It depends on the authors of those libraries to choose the dependency versions. You could modify them with packageExtensions but in the long term that’s not going to be extremely viable as you add more dependencies.