4 ms·
Letting your dependencies automatically update themselves is a great way to introduce security bugs. Not every update is necessarily an improvement. I prefer t
by yen223 8y ago
Letting your dependencies automatically update themselves is a great way to introduce security bugs. Not every update is necessarily an improvement.
I prefer the middle ground of pinning all dependencies, and using an external service to warn if any dependency has a known CVE.
- stouset 8y agoI'd wager that less than 5% of your language dependencies bother to issue CVEs when they release security fixes. They get a bug report, fix the problem, and carry on with their life. This also happens all the time with bugs that nobody realizes are security vulnerabilities, because they're "just" crash on invalid input bugs.