https://remixware.com/tags/supply-chain/ Recent content in Supply Chain on remixware.com Hugo en-us Sat, 31 Oct 2026 00:00:00 +0000 https://remixware.com/remixware-now-fails-pull-requests-that-bring-in-risky-dependencies/ Sat, 31 Oct 2026 00:00:00 +0000 https://remixware.com/remixware-now-fails-pull-requests-that-bring-in-risky-dependencies/ <p>A pull request that adds one line to <code>package.json</code> can add forty packages to the lockfile. Reviewers read the line. Hardly anyone reads the lockfile, and that&rsquo;s where a package nobody chose, or one that runs a script on every developer&rsquo;s machine at install time, gets in.</p> <p>Remixware 0.3 adds a second check for that moment. <code>remixware deps</code> compares the packages your lockfiles name with the ones on your main branch. A new package that isn&rsquo;t on your allow list fails the change, whether you asked for it or another package pulled it in. So does an added or updated package that runs code when it&rsquo;s installed, and, if you let it look online, a recent release by someone who didn&rsquo;t publish or maintain the version before it.</p>