Reporting the same security issue to pnpm vs bun:
pnpm acknowledged it quickly, shipped a fix, backported it, and published an advisory.
bun never acknowledged, silently fixed this and another issue I reported, has not published advisories.
One takes security more seriously.
@darcy Yeah, I’ll look into it tomorrow when I’m back at my computer. I tried the latest version I think, but maybe I was accidentally using an old version.
@darcy I think I tried out all the pkg managers I could think of at the time. Right now, vlt spins indefinitely resolving deps for me. Advisory is here: https://t.co/Kz1GQuCjg7
For bun, there was a second more critical issue where it was not storing checksums for any https dependency.
@loosenedspirit@thdxr I don't know how anyone trusts it and it's been this way for a while. Obviously lots of good perf ideas in Bun, but I remember in Deno we looked at adopting a few of them and sometimes it was a correctness or probably a security issue.
@StartupSpells@boshen_c@JoviDeC Not a good comparison.
> And majority of the world hates change.
Changing the underlying registry and nothing else drastically changes the semantics for users—`pnpm install <package-name>` no longer means what it's meant in the past.
@StartupSpells@boshen_c@JoviDeC Plus, saying "I want this package from jsr and not npm" by using `jsr:` is not that hard for users. People aren't that stupid.
@StartupSpells@boshen_c@JoviDeC Existing clients using a new registry by default sounds terrible and will make the security situation worse because different packages will be installed based on what registry is configured. In existing tools, integrating a new registry should not introduce ambiguity.
@boshen_c@JoviDeC JSR has an npm compatibility layer that works the same as npm and it works in pnpm and yarn at `jsr:`. Are you suggesting something where people can swap https://t.co/BmtV23woEt for an entirely new registry with different packages?
@dpc_pw@IntCyberDigest So it's pull_request_target along with checking out the PR branch. That caused it to run on the main branch with secrets and the main branch workflow file did a checkout of the PR branch https://t.co/lhQoFkMs7l
@dpc_pw@IntCyberDigest So it's pull_request_target along with checking out the PR branch. That caused it to run on the main branch with secrets and the main branch workflow file did a checkout of the PR branch https://t.co/lhQoFkMs7l
@dpc_pw@IntCyberDigest pull_request_target has access to the github_token (https://t.co/G625wnUiEl). Looks like they’ve been fixing it https://t.co/LcMaT1L0P3
The latest version of dax (https://t.co/FN47KnnbCf) can show a scrolling view of the last N lines when executing a command. This is especially useful when running multiple commands in parallel.