8 ms·
Dependency ranges mean package updates happen automatically. So a minor release could contain malicious code without anyone noticing. I still think semver is wo
by matthewbauer 7y ago
Dependency ranges mean package updates happen automatically. So a minor release could contain malicious code without anyone noticing. I still think semver is worthwhile even if it a little bit more vulnerable to this kind of attack.
- solidasparagus 7y agoYeah, but a dependency attack is a rarer issue than out-of-date dependencies that contain known security vulnerabilities.