TJTorola
Joined 10 years ago
Karma
78
Submissions
34
Member since
May 2
Joined 10 years ago
But it's also missing the value of hashes, even if every package used symver, then you had a script that could easily update to get recent security updates, we would still gain value from a lockfile hashes to protect against source code changing underneath the same version code.