More a case for something like this from Show HN three months ago

An artifact manager. Only get what you approve. So you can get fast updates when needed and consistently known stable when you need it. Does need a little config override - easy work.

I had my own janky tooling for something like it. This is a good project.

▲

Johnny555 10 hours ago | parent [-]

Does that really scale well? Thanks to cascading dependencies, even a medium sized project can import hundreds of dependencies. Can a developer really review them all to figure out if they are safe and that there's not security fix that was fixed in a newer version of the package?

	▲	jpollock 7 hours ago \| parent \| next [-]
		Yes, that is what is required. Every dependency needs an internal owner and reviewer. Every change needs to be reviewed and brought into the internal repository. If no one is willing to stand up and say "yes this is safe and of acceptable quality", why use it? It's a software engineering version of the professional engineering stamp.
	▲	edoceo 7 hours ago \| parent \| prev \| next [-]
		I love the sibling response from @jp... Also, IME we don't deep dive everything (should we?) For most stuff we make sure the latest is not-shit and passed test cases. We do have ceremony around version bumps.
	▲	8 hours ago \| parent \| prev [-]
		[deleted]