6 ms·
> The reality is that each update is its own potential security issue Even beyond security issues: each update is a new opportunity for breakage, not only from
by cesarb 2mo ago
> The reality is that each update is its own potential security issue
Even beyond security issues: each update is a new opportunity for breakage, not only from bugs in the third-party package, but also from unexpected dependencies on the third-party package's behavior.
- yearolinuxdsktp 2mo agoAnd that’s exactly why semantic versioning provides only an illusion of stability. This is also why ecosystems that don’t pin their versions such as floating versions that are the default in JavaScript ecosystems are so much more vulnerable from a security and a regression standpoint.