Re: 100MB of Node.js modules shipped in the Boost release tarball
Andrey Semashev via Boost <[email protected]> Wed, 17 Jun 2026 23:22:55 +0300
| Newsgroups | gmane.comp.lib.boost.devel |
|---|---|
| Message-ID | <[email protected]> |
On 17 Jun 2026 21:58, Sam Darwin wrote: > >> fixed known good versions > > The nodejs installations use package-lock.json files to lock the versions. Does this mechanism guarantee fixed versions of the downloaded components of the entire dependency chain? That is, does it prevent a dependency from updating from one Boost build to another without our consent? > At the time of a boost release, a completely new archive isn't > generated, suddenly introducing a problem. Rather, a previous snapshot > is renamed. If a vulnerability appeared during the lock-down period, we > would at least have some chance to react. Then compromising a snapshot build is just as dangerous as compromising the release. _______________________________________________ Boost mailing list -- [email protected] To unsubscribe send an email to [email protected] https://lists.boost.org/mailman3/lists/boost.lists.boost.org/ Archived at: https://lists.boost.org/archives/list/[email protected]/message/2PRWECU2I4FMGKX4UZE2IPGKFWVLXJF4/