3 ms·
? It has always been the case that if you don't specify a version, the latest is implied.
by guappa 1y ago
? It has always been the case that if you don't specify a version, the latest is implied.
- slau 1y agoWhether it’s the latest or not is irrelevant. What’s important is the actual package hash. This is the only way to have fully reproducible builds that are immune to poison-the-well attacks.
- guappa 1y agoThat would be true if anyone actually ever reviewed the dependencies. Which is not the case. So the version doesn't matter when any version is as likely to contain malware.