I noticed something odd on our Bun projects: every Dependabot alert was about a direct dependency. Never a transitive one.
It turns out GitHub's dependency graph doesn't read bun.lock yet. It supports package-lock.json, yarn.lock and pnpm-lock.yaml, but for Bun it falls back to package.json. So:
Hey r/reactjs,
Like many of you, I've used React Hook Form and Formik across several production projects. While they're powerful, I always felt friction with how modern form libraries force you to treat standard HTML forms as legacy: - Having to manually register every input with refs: {...register("email")}
- …
You can customize this digest to include all the sites and sources you want.
