2 ms·
Better to treat it as a dependency still, but audit each new commit/release as it comes in, and pin to the exact last commit id that you verified.
by pabs3 5mo ago
Better to treat it as a dependency still, but audit each new commit/release as it comes in, and pin to the exact last commit id that you verified.
- deepsun 5mo agoYes, but no one audits new dependencies versions usually. Only Release Notes mostly.