[#]Golang has this concept of vulnerabilities where if your code doesn’t use the vulnerable code in the package it won’t mark your project as being vulnerable to it. The #javascript and #typescript ecosystems desperately need this. I know there are more challenges in JS world to doing this in practice though. But the amount of false positives makes vulnerability reporting for #typescript and #javascript useless to many.
=> More informations about this toot | View the thread | More toots from renedudfield@fosstodon.org
=> View golang tag | View javascript tag | View typescript tag This content has been proxied by September (3851b).Proxy Information
text/gemini