Pinned dependencies usually have their own dependencies so you are generally always downloading random code and hoping.

I mean, jeeze, how much code comes along for the ride with Electron...

cosmic_cheese 6 hours ago | parent | next [-]

The real answer is to minimize dependencies (and subdependencies) to the greatest extent practical. In some cases you can get by with surprisingly few without too much pain (and in the long run, maybe less pain than if you'd pulled in more).

	▲	Scramblejams 6 hours ago \| parent [-]
		Yep, and for the rest I've gotten a lot of mileage, when shipping server apps, by deploying on Debian or Ubuntu* and trying to limit my dependencies to those shipped by the distro (not snap). The distro security team worries about keeping my dependencies patched and I'm not forced to take new versions until I have to upgrade to the next OS version, which could be quite a long time. It's a great way to keep lifecycle costs down and devops QoL up, especially for smaller shops. *Insert favorite distro here that backports security fixes to stable package versions for a long period of time.

▲

chrisweekly 4 hours ago | parent | prev [-]

No. "Always downloading random code and hoping" is not the only option. Even w/ the supply-chain shitshow that the public npmjs registry has become, using pnpm and a private registry makes it possible to leverage a frozen lockfile that represents the entire dependency graph and supports vulnerability-free reproducible builds.

EDIT to add: Of course, reaching a state where the whole graph is free of CVEs is a fleeting state of affairs. Staying reasonably up-to-date and using only scanned dependencies is an ongoing process that takes more effort and attention to detail than many projects are willing or able to apply; but it is possible.