daniel r(ooooooh) in nyc 🇺🇸 on Mythryl: “I would always want to reduce our dependencies!”

in light of the current supply chain attacks, I've just published a @github.com action to detect packages that _lose_ their provenance. 📦 supports pnpm-lock.yaml, package-lock.json, yarn.lock (v1) 🎨 inline GitHub annotations ✅ JSON output + configurable 💪 published in TS with zero deps

github.comGitHub - danielroe/provenance-action: GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn).GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn). - danielroe/provenance-action

BlustinBlieber

@justatorus.bsky.social

19 Sept 2025

Would you consider reducing the dependencies in Nuxt a priority going forward? Many smaller deps could be vendored or consolidated

Post