The history of Bundler is linked to RubyGems. RubyGems, first released in 2004 by Chad Fowler, is a package manager that makes it possible to distribute and manage Ruby libraries, applications, and their dependencies. - Source: dev.to / 11 months ago

CocoaPods can, however, also be installed using Bundler and then invoked via bundle exec .... This ensures that everybody on the team is using the same CocoaPods version. Source: about 1 year ago

I'm really confused by following the bug trail to https://github.com/rubygems/rubygems/pull/4475 and finding zero documentation upon https://bundler.io/. Source: about 1 year ago

The next step is setting up the fastlane workflow, which will take care of building, signing and deploying the Expo React Native mobile app. Fastlane is being used as it automates many tedious tasks that can be tricky to get right using the platform provided CLI tooling. Since fastlane is a Ruby package Bundler will be used to define the dependency, to make it easy for other developers to run it and to enable... - Source: dev.to / over 1 year ago

I first encountered this idea with Rubygems, specifically with Bundler, which, literally on its homepage, encourages you to check in both Gemfile and Gemfile.lock. Source: over 1 year ago

Another option is to use a Dependency Firewall, such as Bytesafe, which allows you to quarantine unwanted open source packages with vulnerabilities or non-compliant licenses. The platform provides a policy engine where you define the open source usage and security rules and the Dependency Firewall does the enforcement. - Source: dev.to / over 1 year ago

There are a few companies in this space that are trying to do the "Security Seal of Approval" thing to various degrees. Tidelift is one company that has a bunch of "catalogs"[0] of packages. I'm not sure how their package metadata is generated though -- maybe semi-manually? There is also Bytesafe[1] which is supposed to help give you a way to "firewall" yourself from unapproved dependencies. I don't think they... - Source: Hacker News / over 1 year ago

I was trying bytesafe.dev recently and it was good for me, as it would stop the npm install of any package that had a security issue. But now that I am out of the free trial, it is to limited for me without paying for an upgraded plan. And their support never replies to my requests. Source: about 2 years ago

These steps will let you get your own private repository using Bytesafe:. - Source: dev.to / over 2 years ago

When using private repositories from Bytesafe, public dependencies will be proxied, pulling any required (and allowed) version into your private Maven repository. Using public repositories like Maven Central as an upstream makes sure you can access your organization's required open source dependencies - while maintaining security and control. - Source: dev.to / over 2 years ago