4 ms·
A large number of security issues in the supply chain are found in the weeks or months after library version bumps. Simply waiting six months to update dependen
by echelon 7mo ago
A large number of security issues in the supply chain are found in the weeks or months after library version bumps. Simply waiting six months to update dependency versions can skip these. It allows time to pass and for the dependency changes to receive more eyeballs.
Vendoring buys and additional layer of security.
When everyone has Claude Mythos, we can self-audit our supply chain in an automated fashion.
- kpcyrd 7mo agoYou don't need vendoring for this, Cargo.lock already gives you locked-dependencies until you run `cargo update`. There is an ongoing RFC to support having cargo intentionally only use library versions that are least X days old: https://github.com/rust-lang/rfcs/pull/3923 https://github.com/rust-lang/rfcs/pull/3923