3 ms·
how?
by wheelerwj 7y ago
how?
- matthewbauer 7y agoDependency ranges mean package updates happen automatically. So a minor release could contain malicious code without anyone noticing. I still think semver is worthwhile even if it a little bit more vulnerable to this kind of attack.
- solidasparagus 7y agoYeah, but a dependency attack is a rarer issue than out-of-date dependencies that contain known security vulnerabilities.
- pdpi 7y agoBecause if you don't consider SemVer as part of your threat model, you'll specify "v1.2.3 or above" instead of "v1.2.3".