reply on: Stacker Saloon \ stacker news

pull down to refresh

98 sats \ 6 replies \ @optimism 8h \ on: Stacker Saloon

I find it sad but perhaps it is also interesting that I'm in a situation I've not found myself in at this scale before:

I have, across 8 BOMs, a growing list of 3rd party libraries that with subsequent releases are getting worse instead of better. As in the bugs aren't getting fixed and with each release, new ones are getting introduced. The craziest instance among the set is now worsening for 8 releases in a row and the bugs are stacking up. Not trivial bugs either... the majority are DoS vulns or hard regressions. PRs are getting closed without merge, without solution. From multiple maintainers, most of them veterans.

Is anyone else seeing this?

126 sats \ 4 replies \ @k00b 8h

Your attention to detail is much higher than mine (and most) but I am seeing release notes blow up and vulns getting fixed in releases also introducing 10s of new things.

89 sats \ 2 replies \ @optimism 7h

I see that too. This morning inside the slop for one of the 8 npmjs packages I have under continuous monitoring, one of the analytic bot processes I run automagically to prepare my own analysis and filter out nonsense started with the remark:

It fixes less than it looks like

Well yeah no shit sherlock... that was +20k sloc on a low level library that didn't fix anything. twenty thousand lines of source code and it does nothing. Doesn't fix bugs, introduces 2 massive regressions... on a pattern matcher. These are regressions as in what matched before doesn't match now. what in the actual fuck?

Over a billion installs per week.

1 sat \ 0 replies \ @k00b 53m

Doing egress stuff today I encountered two pretty nasty bugs in the latest 22.x nodejs release, so perhaps I am seeing this stuff but don't have all your context and take it for granted.