4 ms·

Every pinned dependecy is a security vulnerability, sooner or later.

• brokegrammer 1y ago
  Once a dependency turns into a security vulnerability, you can either replace it, or write your own library like I suggested. It's more cost effective and time efficient than writing your own libraries from scratch for every project. For example, I'd rather install React Router for routing in a React app instead of writing my own routing library. I guess some people will reply "grrr React, just use static HTML bro". Okay cool.
  • teddyh 1y ago
    > Once a dependency turns into a security vulnerability How will you know if/when that happens? Are you subscribed to the development channels of all your dependencies? Do you examine every one of their commits for security fixes?