silverwind
Joined 657 karma
- silverwindPinning actions doesn't really work because most action dependencies are unpinned thanks to npm default behaviour of not pinning them.
- SVG can for example contain text elements rendered with a font. If the font is not available it will render in a different one. The issue can be avoided by turning text elements into paths, but not all SVGs do that.
- svgo is a minifier, not a sanitizer.
- You should run VPN on your gateway instead.
- Sounds like planned obsolescence if devices stop working after 5 years or less.
- Not a problem if you have the cert on a shared load balancer, not on the services directly.
- > This happens with things like os.UserHomeDir or some networking things like DNS lookups.
The docs do not mention this CGO dependency, are you sure?
- They shouldn't be loaded in a React SPA at least, e.g. `react-dom` and `react` packages should be unaffected.
- I wish they would contribute stuff like this memory snappshotting to CPython.
- These namespaces do not merge cleanly, for example `content`.
- Why not make a opt-in "strict mode" for CSS that fixes all these issues?
- The quality of setup-* actions has definitely gone down and there are a lot of strange decisions being made. I assume the original authors of these actions have long left the company.
- This is missing a "if variable equals" imho. Right now it seems like pure syntactic sugar for a media query.
- > No one should be using 3.0.x anymore
Many users are stuck at 3.0 or even Swagger 2.0 because the libraries they use refuse to support recent versions. Also OpenAPI is still not a strict superset because things like `discriminator` are still missing in JSON schema.
- Deno has tackled some of these issues with their permission system, but afaik it can only be applied to apps, not to dependencies.
What we really need is a system to restrict packages in what they can do (for example, many packages don't need network access).
- This has improved recently. Packages like lodash were once popular but you can do most stuff with the standard library now. I think the only glaring exception is the lack of a deep equality function.
- > The culture with using version ranges for dependency resolution
Yep, auto-updating dependencies are the main culprit why malware can spread so fast. I strongly recommend the use `save-exact` in npm and only update your dependencies when you actually need to.
- Seems like a worse version of `before` because `before` also handles indirect dependencies, whil this module does not seem to.
- Interestingly, the bug for this feature is already 17 years old (https://bugzilla.mozilla.org/show_bug.cgi?id=435426).