@axios

Mitchell Hashimoto is advising developers to stop updating software dependencies and instead fork and trim libraries, updating only when user-facing issues arise. The recommendation follows a spring o…

Setting a minimum release age (cooldown) on dependencies is a low-effort, high-impact defense against supply-chain attacks, as most malicious packages are detected and removed within hours. All three …