Dependency prefixes like ^ and ~ make updates easy, but the version ranges they create widen the path a compromised package can take into production.
Full article content could not be extracted automatically. Read the original below.
Dependency prefixes are a supply chain risk: let's fix them
Dependency prefixes like ^ and ~ make updates easy, but the version ranges they create widen the path a compromised package can take into production.