Dependencies Belong in Version Control

• vue-cli

  86 29,758 0.0 JavaScript

  🛠️ webpack-based tooling for Vue.js Development

  

Security would be a useful benefit/section to add to this post:

A.) If maintainers of your dependencies edited an existing version.

B.) If your dependencies did not pin their dependencies.

For instance, if you installed vue-cli in May of last year from NPM with --prefer-offline (basically the same as checking in your node_modules), you were fine. But because vue-cli doesn't pin its dependencies ("node-ipc"), installing fresh/online would create WITH-LOVE-FROM-AMERICA.txt on your desktop [1], which was at the very least a scare, but for some, very problematic.

[1] https://github.com/vuejs/vue-cli/issues/7054

• p4vfs

  3 253 7.6 C++

  Microsoft Virtual File System for Perforce

  

There is also this - https://github.com/microsoft/p4vfs and several other solutions - just need to dig around.

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

• nix.dev

  17 2,041 9.6 Nix

  Official documentation for getting things done with Nix.

  

Nix (https://nix.dev/) can provide all of this, although in a smarter way than just through dumping everything in the VCS. Some projects use it already to provide a reproducible development environment and if done right a clean build is just a `nix-build` away.

• Vcpkg

  146 21,500 10.0 CMake

  C++ Library Manager for Windows, Linux, and MacOS

  

vcpkg may expire assets after 1.5 years, so achieve long-term reproducibility you will need to cache your dependencies.... Somewhere. Not sure what the expected solution is.

https://github.com/microsoft/vcpkg/pull/30546#issuecomment-1...

Suggest a related project