| 2 Oct 2025 |
 dish [Fox/It/She] | and there would be way less if projects would vendor a package-lock.json >:( | 04:02:27 |
| dish [Fox/It/She] | and i do not want to shove like 50 package-lock files into nixpkgs | 04:02:35 |
| dish [Fox/It/She] | the whole reason im doing this is to reduce the amount of bloat in nixpkgs and it would prob be more efficient to keep the set over having a bunch of package-locks lol | 04:03:00 |
| dish [Fox/It/She] | I think this is something that nixpkgs needs to solve(some way of creating a trusted source of lockfiles that can be fetched externally so that we don't have to vendor them inside nixpkgs) | 04:17:09 |
 Emma [it/its] | wouldnt you have to do that anyways to avoid IFD? | 04:18:50 |
| dish [Fox/It/She] | too many projects have gotten the habit from sindresorhus of not having lockfiles in-tree >.> | 04:19:03 |
| dish [Fox/It/She] | sigh yeah | 04:19:08 |
| dish [Fox/It/She] | fuck | 04:19:12 |
| dish [Fox/It/She] | well im not about to vendor a 538kb lockfile just to avoid ifd | 04:19:27 |
| dish [Fox/It/She] | so i guess that package i was looking at won't be repackaged for a while | 04:19:38 |
| Emma [it/its] | meanwhile noVNC not locking packages at all | 04:20:59 |
| Emma [it/its] | not even to major versions | 04:21:07 |
| dish [Fox/It/She] | what the | 04:21:11 |
| dish [Fox/It/She] | 😠| 04:21:15 |
| Emma [it/its] | https://github.com/novnc/noVNC/blob/master/package.json | 04:21:30 |
| dish [Fox/It/She] | oh gods | 04:21:30 |
| dish [Fox/It/She] | i just looked at their repo | 04:21:33 |
| dish [Fox/It/She] | yeah | 04:21:33 |
| dish [Fox/It/She] | wow thats awful | 04:21:36 |
| Emma [it/its] | not making this up, everything is "latest" without a lockfile | 04:21:38 |
| dish [Fox/It/She] | hmm yes i love security | 04:22:02 |
| dish [Fox/It/She] | | 04:22:14 |
| Emma [it/its] | yeah, i feel bad for the Proxmox-NixOS folks | 04:22:22 |
| Emma [it/its] | the proxmox web ui relies on novnc 😠| 04:22:51 |
| dish [Fox/It/She] | this is why i only give myself one painful project at a time | 04:30:02 |
| dish [Fox/It/She] | and currently thats minimal-bootstrap | 04:30:07 |
| dish [Fox/It/She] | though they seem to not even need the package-lock so 🤷 | 04:32:31 |
| Emma [it/its] | cant you fetch them theoretically? or would that still be IFD | 04:33:28 |
| Emma [it/its] | im guessing fetch* is still a derivation... | 04:33:54 |
| dish [Fox/It/She] | well | 04:34:09 |
