News for hackers. Stuff that matters.

A comment on Malicious PyPI packages stealing credit cards and injecting code. Parent comment

Re:Malicious PyPI packages stealing credit cards and injecti... by watermelon0 on Tuesday August 03, 2021 @01:16PM (#28051715)
AFAIK Maven and Gradle don't have any built-in way of locking down dependencies (direct or transient), unless I missed something.
[ Parent | on HN ]
Re:Malicious PyPI packages stealing credit cards and injecti... by cesarb on Tuesday August 03, 2021 @03:50PM (#28053314)
In my experience, Maven always uses the exact version specified in your pom.xml (and the pom.xml of your dependencies, transitively), it never uses a newer version automatically. That is, the built-in way in Maven is locked down dependencies.
[ Parent | on HN ]