I mean even if you blindly copy in the dependency (I'm not saying you should) you've already solved two supply chain issues with install-on-prod:
- dependencies "disappearing" (aka left pad 2, electric boogaloo)
- dependencies running nefarious "install scripts" on prod
Apparently some language package managers also will silently install newer versions than a lock file specifies, if you use the wrong install command. So that's arguably more a case of saving you from yourself but the example I saw said that "... install" is wrong you need to use "... ci" which is kind of asinine IMO.
Things like sudden changes in dependencies should also be noticed more readily.
- dependencies "disappearing" (aka left pad 2, electric boogaloo)
- dependencies running nefarious "install scripts" on prod
Apparently some language package managers also will silently install newer versions than a lock file specifies, if you use the wrong install command. So that's arguably more a case of saving you from yourself but the example I saw said that "... install" is wrong you need to use "... ci" which is kind of asinine IMO.
Things like sudden changes in dependencies should also be noticed more readily.