4 ms·

Out of date dependencies also introduces vulnerabilities though. So you’re screwed no matter what.

• leros 3y ago
  That is true. So you need to continually audit those dependencies as well and upgrade them when security requires it.
  • uecker 3y ago
    Essentially this is was distributions such as Debian do for your (if you trust them and their security enough which depends on your requirements). xz is noteworthy because someone spent more than two years trying to subvert this. Note that the distributions used by package managers such npm, pip, or cargo do not do this. So be wary of the "all old is bad and needs to be rewritten and C does not even have a proper package manager" crowd. (memory safety is a good thing though)
  • hackable_sand 3y ago
    Or fork and cache with dedicated maintenence, if that's what you were indicating above.
    • leros 3y ago
      Not forking. There are systems for internal dependency management. You can have an internal npm or maven or whatever with only approved packages and versions.
  • cdmckay 3y ago
    This is not realistic for most startups. You’d spend all your time reviewing packages and no time building.
    • leros 3y ago
      100%. It's also awful inside a big corporation. Imagine waiting weeks or months to get a new package approved.