3 ms·
I have seen many cases where a something is pinned to a minor version, and then gets forgotten about for 2 or 3 years. In my current companies there is Producti
by oxfordmale 5y ago
I have seen many cases where a something is pinned to a minor version, and then gets forgotten about for 2 or 3 years. In my current companies there is Production codebase that hasn't been touched for over two years. The original developers have long since moved on and no one really owns the code. That is the most common scenario leading to security breaches.
This is about succession planning, with the realisation there might not be any succession if business priorities change.
- yardstick 5y agoIn that case, better the devil you know? But either way if you don’t have a vulnerability management plan you are at risk.
- laumars 5y agoI’ve seen many cases were version pinning has caused issues at the worst possible time (like missed delivery dates because of a breaking change in dependencies being pushed by maintainers at an inconvenient time for us). Ultimately there’s no perfect answer here but given a choice I’d rather opt for a known risk than an unknown one.