/job/ - Job Board

finding out about a broken npm package during a build is pure nightmare fuel. by the time the scanner flags it, the dev has already moved on to completely different tasks and the code is deeply embedded in the repo.
>it's basically just debugging trauma at that point.
how are you guys handling dependency audits before they hit the pipeline?

found this here: https://dev.to/leobaniak/ci-is-the-wrong-place-to-first-hear-about-your-npm-dependencies-591f