4 ms·
Say you pin your project at version 5. An exploit is found. There is no 5.1. Instead they fixed the exploit in 7. However 7 breaks your pipeline. What do you
by bransonf 6y ago
Say you pin your project at version 5. An exploit is found. There is no 5.1. Instead they fixed the exploit in 7.
However 7 breaks your pipeline.
What do you do? Fix the vulnerability yourself on an outdated version (high effort) Upgrade your entire pipeline to the new version (High effort) Leave the vulnerability in place (terrible idea)
- deleted 6y ago[deleted]
- 411111111111111 6y agoYou left out "switch to a better suited dependency (high effort)" That's honestly the only viable choice with such libraries if you want to deploy your software in production environments. Thankfully, there are alternatives around and you're not forced to migrate every task at the same time