4 ms·
If in some supply chain attack someone switches out a version's code under your seating apparatus, then good look without lock files. I for one prefer being not
by zelphirkalt 1y ago
If in some supply chain attack someone switches out a version's code under your seating apparatus, then good look without lock files. I for one prefer being notified about checksums of things suddenly changing.
- WatchDog 1y agoMaven releases are immutable
- zelphirkalt 1y agoSounds like the Common Lisp approach, where there are editions or what they call them and those are sets of dependencies at specific versions. But the problem with that is, when you need another version of a library, that is not in that edition. For example when a backdoor or CVE gets discovered, that you have to fix asap, you might not want to wait for the next Maven release. Furthermore, Maven is Java ecosystem stuff, where things tend to move quite slowly (enterprisey) and comes with its own set of issues.