Pin package versions and use clean install methods
Open
Nobody has claimed this yet.
Engineering
- Dominant language
- No language data
- Stars
- 9
- Forks
- 3
- PR merge metrics
- No merged PRs in 30d
Description
To avoid pulling new packages and introducing security vulnerabilities, we will move to pinned package versions, and ensuring our ci/cd use clean installs that do not pull new packages.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no specific files, package manager, or tests. Start by locating package manifests and CI configuration, then identify dependency version declarations and install commands. Done means package versions are pinned and CI uses clean installs without fetching unpinned updates.
Written by the indexing model from the issue text.
Assessment
- Domain
- build-system, ci-cd
- Issue type
- Refactor
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 48/100