3 ms·

Well you probably know your top level requirements, but what about their dependencies, and subsequent dependencies? I guess it could happen that a popular packa

• prepend 6y ago
  For production uses, I check them all. It’s a pain, but not that hard to do. I also use dependency checkers that monitor al those various packages for CVEs related to particular versions. I think I typically catch them during dev and GitHub does a pretty good job of detecting and even suggesting updates. There is a risk that a package gets corrupted at a used version, but I think that’s fairly small and would be detected quickly. But I think that’s similar to what would happen if Microsoft or Apple put out a bad update. And pypi is policed better than commercial setups that don’t have checks and balances (eg, SolarWinds)