corpus.blog
42,697 blogs · 5,350,595 posts Claim your blog
Record · corpus.blog/posts/01a0878a-dd69-7278-9229-5652b88ed241

Dependency Updates: latest Is Not a Security Strategy

janbrennenstuhl.eu · published 15 May 2026

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at janbrennenstuhl.eu Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
24
Words captured
1,339

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/
microsoft.com
TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack Read at the source ↗
snyk.io
https://thehackernews.com/2026/05/tanstack-supply-chain-attack-hits-two.html
thehackernews.com
https://slsa.dev/spec/v1.0/levels
slsa.dev
https://docs.npmjs.com/cli/v11/using-npm/scripts
docs.npmjs.com
https://en.wikipedia.org/wiki/Trusted_computing_base
en.wikipedia.org
Every dependency you add is a supply chain attack waiting to happen Read at the source ↗
benhoyt.com
https://semver.org/
semver.org
https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html
cheatsheetseries.owasp.org
https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions
docs.github.com
https://docs.github.com/en/code-security/tutorials/secure-your-dependencies/dependabot-quickstart-guide
docs.github.com
https://docs.renovatebot.com/
docs.renovatebot.com
Turn Dependabot Off Read at the source ↗
words.filippo.io
https://en.wikipedia.org/wiki/XZ_Utils_backdoor
en.wikipedia.org
https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack
wiz.io
https://docs.npmjs.com/cli/v11/configuring-npm/package-json
docs.npmjs.com
https://nesbitt.io/2026/03/04/package-managers-need-to-cool-down.html
nesbitt.io
https://www.wiz.io/blog/practical-package-security-the-unofficial-guide
wiz.io
https://socket.dev
socket.dev
https://www.sonatype.com/products/sonatype-nexus-repository
sonatype.com
https://jfrog.com/artifactory/
jfrog.com
https://go.dev/doc/tutorial/govulncheck
go.dev
https://go-proverbs.github.io/
go-proverbs.github.io
Our Software Dependency Problem Read at the source ↗
research.swtch.com
Elsewhere on janbrennenstuhl.eu (1)