8 replies

1. naugtur Bluesky 14 hr later

   Or try the preview release of www.npmjs.com/package/@lav...
   and get some more security improvements out of that while you're at it 😉

   1. Zach Leatherman Bluesky 20 hr later

      I do usually try to avoid adding dependencies for this type of thing — there is a weird line to walk there 🫣

      1. naugtur Bluesky 20 hr later

         Exactly why I'm building this tool now - we used to have a tool you need to install. This one you can run once, even install in a throwaway container, and it makes changes to config files for you. And the wizard asks you questions.

         1. naugtur Bluesky 20 hr later

            The descriptions will layer link to more docs, so it's easy to know what exactly you're agreeing to.

            1. Zach Leatherman Bluesky 21 hr later

               great! if it isn’t too far I might recommend elevating that laundry list of what it does specifically in the README!

               1. naugtur Bluesky 1 day later

                  That's the plan for 1.0
                  For now I'm still fiddling with opinions and your feedback would be much appreciated ;)

2. Burton Smith Mastodon 20 hr later

   @zachleat this is only for dependencies?

   1. Zach Leatherman Mastodon 20 hr later

      @stuffbreaker ah, yeah it’s an allow-list of dependency names? not sure what you mean exactly