5 ms·
don't you then introduce a new risk? with a gap between the update of your deps, you are at risk of systematically being unpatched for a window of time that th
by egnehots 9d ago
don't you then introduce a new risk?
with a gap between the update of your deps, you are at risk of systematically being unpatched for a window of time that the attackers know (just after a fix is published).
- orlp 9d agoThe above is a general rule protecting you against supply chain attacks by default. If there is an important CVE published with a patch you can manually review that patch and bypass the minimum-age requirement for that dependency specifically.