3 ms·

That does not help you if the bug is one of many unmaintained crates and never noticed. Linux distributions aim to make sure that C application dynamically lin

by uecker 1y ago

That does not help you if the bug is one of many unmaintained crates and never noticed. Linux distributions aim to make sure that C application dynamically link to the right libraries instead of vendoring the code. Then the library can be updated once. IMHO this is the only reasonable approach.

simonask 1y ago
It's trivial to see on crates.io whether a crate is unmaintained.
- uecker 1y ago
  Maybe if it is completely unmaintained, but this is not enough to solve the problem and maybe also not really the point.
- shwouchk 1y ago
  is it trivial to see if a third level dependency is unmaintained?