4 ms·

Version numbers. You can’t modify an already-published version of a Rust crate on crates.io.

• palata 3y ago
  Who in practice pins their dependencies (transitive included) on audited versions?
  • rockdoe 3y ago
    Small companies with little development experience like Google and Mozilla. (You can check the files I linked and see audits between deltas for minor version updates)
    • palata 3y ago
      I guess my point was: "because [some teams at] Google/Mozilla do it right does not mean that everybody does it right".