You bump a direct dependency to pull in a patched transitive. bun audit goes green. The lockfile is committed. Two weeks later, someone does a clean install on a fresh machine, and the vulnerable tran
Markdown supported · ⌘↵ to post
No responses yet.