qaz@lemmy.world to Selfhosted@lemmy.worldEnglish · 2 days agoAxios JavaScript library has been compromised with malware in supply chain attackgithub.comexternal-linkmessage-square12fedilinkarrow-up1219arrow-down11cross-posted to: opensource@lemmy.ml
arrow-up1218arrow-down1external-linkAxios JavaScript library has been compromised with malware in supply chain attackgithub.comqaz@lemmy.world to Selfhosted@lemmy.worldEnglish · 2 days agomessage-square12fedilinkcross-posted to: opensource@lemmy.ml
minus-squaretaco_shale032@lemmy.mllinkfedilinkEnglisharrow-up8·2 days agoI agree, I think it would be better to use something like dependabot or renovatebot so you can know of and apply security updates right away.
minus-squareEskuero@lemmy.fromshado.wslinkfedilinkEnglisharrow-up11·2 days agoAs long as the bot is not allowed to automatically merge minor version bumps in libraries…
minus-squaremagikmw@piefed.sociallinkfedilinkEnglisharrow-up3·1 day agoWell yes, one can misuse any tool.
I agree, I think it would be better to use something like dependabot or renovatebot so you can know of and apply security updates right away.
As long as the bot is not allowed to automatically merge minor version bumps in libraries…
Well yes, one can misuse any tool.