This package depends on an unpinned git dependency:
|
"libsignal": "git+https://github.com/whiskeysockets/libsignal-node", |
I recommend not doing this because breaking changes can be made to that repo without breaking old versions of this dependency because old published versions will always pull in the latest version.
It also presents a bit of a security risk in that if that repo gets compromised then it can push out code to anyone. Also, it's possible to just break everyone by deleting the git repo.
Overall, I recommend versioning and publishing the package to npm because it will work with stuff like "minimum dependency age" and it will work in Deno (right now we don't support git dependencies for security reasons mostly because we haven't designed a system for allowing certain git dependencies)
This package depends on an unpinned git dependency:
Baileys/package.json
Line 47 in ffc019f
I recommend not doing this because breaking changes can be made to that repo without breaking old versions of this dependency because old published versions will always pull in the latest version.
It also presents a bit of a security risk in that if that repo gets compromised then it can push out code to anyone. Also, it's possible to just break everyone by deleting the git repo.
Overall, I recommend versioning and publishing the package to npm because it will work with stuff like "minimum dependency age" and it will work in Deno (right now we don't support git dependencies for security reasons mostly because we haven't designed a system for allowing certain git dependencies)