I'm delighted to discover:
-
I'm delighted to discover:
... listing how you can set dependency cooldowns across various package ecosystems.
If you're the sort of person who's less interested in fixing individual problems than in causing entire classes of problem to not exist, a seven-day cooldown default will do that for you.
-
I'm delighted to discover:
... listing how you can set dependency cooldowns across various package ecosystems.
If you're the sort of person who's less interested in fixing individual problems than in causing entire classes of problem to not exist, a seven-day cooldown default will do that for you.
Can't emphasize this enough, dependency cooldowns are the "wash your hands" of supply chain security, unreasonably effective and basically free.
Wash your hands.
-
Can't emphasize this enough, dependency cooldowns are the "wash your hands" of supply chain security, unreasonably effective and basically free.
Wash your hands.
-
Can't emphasize this enough, dependency cooldowns are the "wash your hands" of supply chain security, unreasonably effective and basically free.
Wash your hands.
-
@evan correct.
-
I'm delighted to discover:
... listing how you can set dependency cooldowns across various package ecosystems.
If you're the sort of person who's less interested in fixing individual problems than in causing entire classes of problem to not exist, a seven-day cooldown default will do that for you.
@mhoye how do you handle security updates with a cooldown? It seems to get quite complicated with dependency chains needlessly getting updated by some tools doing audit fixes.
-
K kramse@helvede.net shared this topic
