3 ms·
You could just pin to a version like a good dev and rid yourself of the problem. Just do a quick diff check when you upgrade. If you're too lazy to do that the
by sieabahlpark 5y ago
You could just pin to a version like a good dev and rid yourself of the problem.
Just do a quick diff check when you upgrade. If you're too lazy to do that then you never really cared about security all that much in the first place.
- Firmwarrior 5y agoWHAT? How am I supposed to make a social media calculator flashlight app without pulling in 200 random libraries and their 5000 dependencies?
- Aachen 5y ago> just pin to a version like a good dev Good devs don't keep up with dependencies' security updates or was this meant ironically? Also, you'd have to pin to a hash, I imagine. Changing the version tag and pushing with -f doesn't sound like rocket science for someone with malice in mind. Next time you deploy it, you'll still get that code.