4 ms·
> Tags vs commit IDs is a tradeoff between convenience and security. Well, it's also a trade-off between security and security. If you specify an immutable com
by jrochkind1 2y ago
> Tags vs commit IDs is a tradeoff between convenience and security.
Well, it's also a trade-off between security and security. If you specify an immutable commit ID, then if the dependency releases a security update you won't get it until you notice and update the commit ID. If you specify a tag, you'll get it on next build.
I guess we need Dependabot updating commitID's in workflows too? But then they'd update you to the vulnerable new @2, how would they know otherwise if it hadn't been reported yet?