Socket.dev reports on all our repos

[wesleytodd]

I think we should add the Socket.dev tooling to all three orgs repos. It is easy to do, I have already done it for some personal repos and some work ones. I find it is the best in class for warning me about changes I might care about in updated dependencies. Anyone opposed to this? I could add it just to one for the time being if we wanted to try it out first.

cc @expressjs/express-tc @expressjs/security-wg

[ctcpip]

I don't really see any downside aside from the noise from comments. (Which shouldn't be just noise if it's doing anything useful.) And we can always remove it.

[wesleytodd]

The one thing I am not sure is how well it reports when we dont have lockfiles. There are good reasons not to have lock files for libraries, but it might be another thing to consider at some point. If we can get reliable automation around testing before publish with fully updated locks then ideally we can add them, but for now even just something to help tell us that a PR like this did not pull in anything surprising would be nice.

[UlisesGascon]

I think we should add the Socket.dev tooling to all three orgs repos.

Yes! 100%

The one thing I am not sure is how well it reports when we dont have lockfiles.

We can do a test and if this is an issue we can revert the integration or explore alternatives.

[ctcpip]

The one thing I am not sure is how well it reports when we dont have lockfiles.

IME with these tools, the only way to know for sure is to fork a repo and compare the results with and without a lock file.

[wesleytodd]

Now that I am thinking about it I think I have this running on some without lockfiles and it is working well. Examples:

wesleytodd/create-git#54 (comment)
wesleytodd/cptmpl#13 (comment)

[UlisesGascon]

Seems like we are good to add it. We can do a fast check with the team in the next TC meeting and enable it

[wesleytodd]

Yep I will add the agenda label. But yeah then I can enable it on a few to start.