The letter

One letter a week, in your inbox.

The signal of the week, what shipped, what to try, and the editor's note. No tracking, no ads, nothing else.

We keep your address, your language and the date you joined, nothing else. Every letter has a one-click unsubscribe link that deletes the record.

← Accept All   Archive
Sourcegraph BlogTools

Dependency prefixes are a supply chain risk: let's fix them

May 22

Dependency prefixes like ^ and ~ make updates easy, but the version ranges they create widen the path a compromised package can take into production.

Read at Sourcegraph Blog ↗

More from Sourcegraph Blog on Accept All.