3 ms·
Semver probably makes the problem worse though.
by matthewbauer 7y ago
Semver probably makes the problem worse though.
- wheelerwj 7y agohow?
- matthewbauer 7y agoDependency ranges mean package updates happen automatically. So a minor release could contain malicious code without anyone noticing. I still think semver is worthwhile even if it a little bit more vulnerable to this kind of attack.
- solidasparagus 7y agoYeah, but a dependency attack is a rarer issue than out-of-date dependencies that contain known security vulnerabilities.
- pdpi 7y agoBecause if you don't consider SemVer as part of your threat model, you'll specify "v1.2.3 or above" instead of "v1.2.3".