News for hackers. Stuff that matters.

A comment on We should all be using dependency cooldowns. Parent comment

Re:We should all be using dependency cooldowns by duped on Friday November 21, 2025 @12:23PM (#46006552)
A million times this. You update a dependency when there are bug fixes or features that you need (and this includes patching vulnerabilities!). Those situations are rare. Otherwise you're just introducing risk into your system - and not that you're going to be caught in some dragnet supply chain attack, but that some dependency broke something you relied on by accident.

Dependencies are good. Churn is bad.

[ Parent | on HN ]
Re:We should all be using dependency cooldowns by latentsea on Saturday November 22, 2025 @07:09AM (#46014193)
I'd rather have excellent quality test suites, and pipelines I can have a high degree of confidence in to catch these issues and mitigate the risk, than dependencies that basically never get updated and then become very difficult to do so, which just introduce different classes of risk.
[ Parent | on HN ]
Re:We should all be using dependency cooldowns by jbkgujklgui on Saturday November 22, 2025 @08:20AM (#46014577)
Vulnerabilities are not rare, the two most popular programming languages, javascript (node) and python, have 1000+ CVEs in their official docker images. I.e. in practice useless and shouldn't be used by anyone for anything.
[ Parent | on HN ]