5 ms·
The problem is vulnerabilities. Your vulnerability scanner says you're pinned dependency has a vuln, and the only solution is to upgrade versions. By and lar
by acoard 6y ago
The problem is vulnerabilities. Your vulnerability scanner says you're pinned dependency has a vuln, and the only solution is to upgrade versions.
By and large, libraries don't backport vulnerability fixes. You have to update from 1.0.1 to 2.3.3 because they only were notified of the vuln after 2.3.2 was released. In practice, almost no open source libraries would also release a 1.0.2. Maybe some of the largest most well-run libraries will, but enough don't that you will run into this problem.
- barumi 6y ago> In practice, almost no open source libraries would also release a 1.0.2. Well, if package consumers such as yourself don't put in the legwork to make that happen then yeah, don't expect others to do the work you personally need for free. I'm sure that if you posted a pull request for that hypothetical 1.0.2 release then the project would gladly receive it with open arms. People should keep in mind that open source software isn't a one-way street.
- abiogenesis 6y agoI don't think the parent comment argues that anyone should backport their changes for free. Their point is, upgrading everything is cheaper than backporting security fixes.