4 ms·
The arguments are directed past each other. Minimal selection breaks down when you ignore it and thereby allow known bugs to pile up. Maximal selection breaks d
by jacques_chester 8y ago
The arguments are directed past each other. Minimal selection breaks down when you ignore it and thereby allow known bugs to pile up. Maximal selection breaks down when you ignore it and thereby allow unknown, untracked dependencies to pile up.
The answer for both is that version updating should trigger CI activity and then be automatically applied when tested. Dependency tools should be as strictly dumb as possible.
This gap exists because dependency management tools blossomed and matured in a manual developer-at-a-keyboard context before the kind of automation that makes their clever bits less relevant or necessary.
- weberc2 8y agoVulnerability scanning favors old versions. If you have this, you’re probably in a (considerably?) safer place with MVS than max selection.
- jacques_chester 8y ago> Vulnerability scanning favors old versions. I don't follow. Could you elaborate?
- weberc2 8y agoVuln scanning depends on vulns having been discovered. These vulns are more likely to be discovered in old versions than new versions.
- jacques_chester 8y agoI agree. But I think we're disagreeing on what policy follows from that.