2026-04-20 09:57 UTC
With all the supply chain attacks going around, we have to be very careful about how we update our dependencies. I've written a full blog post about it, but here is the TLDR:
1. Pin to hashes, not just versions
2. Automate the updates
3. Use dependency cooldowns
https://blog.pecar.me/how-to-safely-update-your-dependencies/
Replies (1)
-
@erwinrossen@mas.to 2026-06-06 09:46
@anze3db@fosstodon.org I read this post a few weeks ago, and thought: that makes sense! But now I was seeing this graph, and learned that there is less than 24 hours between when a vulnerability is found and when it is exploited. Now I am wondering what the correct cooldown strategy should be. Any thoughts on that?