4 ms·
How much supply chain vulnerability can be mitigated just by pinning known safe versions of dependencies Did anyone need the newest xz version in the first pla
by nylonstrung 1y ago
How much supply chain vulnerability can be mitigated just by pinning known safe versions of dependencies
Did anyone need the newest xz version in the first place? What negative tradeoffs would have come from pinning a 2022 release for example
- deafpolygon 1y agoDepends on the pinned version. The pinned version might even have vulnerabilities themselves. The problem is trusting the ecosystem.