180 karma · joined October 2, 2018
Their suggestion is to lock your project dependencies in your package.json file, however this completely ignores the rest of the dependency graph that is brought in as a result of installing those packages, locked or not.
In my experience almost every CVE or exploited package was a dependency of a dependency of a dependency that I have no direct control over.
The only way to ensure dependencies of dependencies aren't changing without your knowledge is to use and commit a lock file.
I haven't seen anything yet about the Suspense component supporting this. I imagine you could wrap the suspense component with your own to achieve this behavior, but it's nice not to have to reimplement.
I seem to remember reading that adding something like `PureComponent` or implementing `shouldComponentUpdate()` can actually slow things down due to the cost of props/state comparison?
Either way thanks for another great release team! Suspense has me super excited!