Your editor is a dependency, so give it a lockfile and a reviewer

PHP teams argue over every line in composer.lock, then let their editors update a dozen extensions in the background without anyone looking.

This year showed that a trusted extension release can be enough to compromise a machine. Kai argues the editor's extension set should be owned by the team and reviewed like any other dependency, and that this costs less than you'd expect.

▶ continued: summary & source

An editorial by Kai