The letter

One letter a week, starting soon.

The week's signal, what shipped, what is worth running tonight, and the editor's note. No tracking, no ads, nothing else.

We keep your address, your language and the date you joined, nothing else. Every letter has a one-click unsubscribe link that deletes the record.
← Accept All   Archive
Sourcegraph BlogTools

Dependency prefixes are a supply chain risk: let's fix them

05.22

Dependency prefixes like ^ and ~ make updates easy, but the version ranges they create widen the path a compromised package can take into production.

Read at Sourcegraph Blog ↗

More from Sourcegraph Blog on Accept All

ToolsHow we're using Sourcegraph and a Slack bot to detect vulnerabilities and react quickly Sourcegraph Blog

ToolsWhy coding agents fail in large codebases (and what to do about it) Sourcegraph Blog

ToolsLessons on UX, security, and scale when building an enterprise-grade Slack agent Sourcegraph Blog

ToolsCode Search, Deep Search, or MCP: When to Use Each Sourcegraph Blog

ToolsWhat it actually takes to run code intelligence in-house Sourcegraph Blog

ToolsDetecting supply chain attacks at scale with Deep Search Sourcegraph Blog

More from Sourcegraph Blog on Accept All.