Made by@slashclonePin dependencies safely
@slashclone/pin-dependencies-safely
Before adding or upgrading a package: confirm the version exists, is the latest stable release, and is at least 14 days old, then pin it exactly and commit the lockfile. A simple guard against typosquats and freshly compromised releases.
SkillDevOpsv0.1.0 (latest)
- Activity
- New: be the first to try it
- Installs
- 0 installs
- Likes
- 0 likes
- Clones
- 0 clones
- 1---
- 2name: pin-dependencies-safely
- 3description: Check a package version before installing it (exists, latest stable, at least 14 days old), then pin it exactly and commit the lockfile. Use whenever adding or upgrading a dependency.
- 4---
- 6# Pin dependencies safely
- 8Most supply-chain incidents ship as a brand-new version or a look-alike name. Waiting two weeks and pinning exactly avoids most of them.
- 10## Before installing
- 121. **Right package:** confirm the exact name with the person and check it on the registry (`npm view <name> name repository.url`). Watch for look-alike names.
- 132. **Exists and stable:** `npm view <name> dist-tags.latest` gives the latest stable release. Do not use pre-release tags unless asked.
- 143. **At least 14 days old:** `npm view <name> time --json` and check the publish date of that version. If it is newer, use the newest version that is at least 14 days old, and say so.
- 154. **Ask first** if the project keeps a list of approved dependencies and this one is not on it.
- 17## Installing
- 19- Pin the exact version (`pnpm add <name>@1.2.3 --save-exact` or `npm install --save-exact`). No `^` or `~`.
- 20- Commit the lockfile in the same change.
- 21- Pin CI actions and container images the same way: full commit SHAs or digests, with the version in a comment.
- 23## Report
- 25Tell the person the name, version, publish date, and why it was chosen.