Post #2296208
2026-05-07 17:11 UTC
Hey #Python library maintainers! 👋 I sometimes see pull requests from well-meaning users about bumping minimum versions of dependencies to "fix security vulnerabilities". Here's a resource you can link to about why this strategy doesn't work in practice:
https://sethmlarson.dev/library-version-specifiers-not-for-vulnerabilities
#python #security #oss #opensource #vulnerability
Replies (4)
-
@diazona@techhub.social 2026-05-07 17:16
@sethmlarson@mastodon.social Nice! This has been a bit of a pet peeve of mine too for a long time, but it's good to have a writeup from someone with credibility 😁
-
@miguelgrinberg@mstdn.social 2026-05-08 07:20
@sethmlarson@mastodon.social Great article. Somewhat related, I also find that the practice of setting version upper bounds in library dependencies is more often causing problems for users than helping them.
-
@adamchainz@fosstodon.org 2026-05-08 16:21
@sethmlarson@mastodon.social @hugovk@mastodon.social Nice one, thanks for the write up I can send to folks.
-
@sloanlance@mastodon.social 2026-05-12 02:27
@sethmlarson@mastodon.social Cool sweatshirt you're wearing in that photo!