2026-10-26 19:11 UTC
You don’t get any of that when you vendor, and you’ll have to manually actively monitor your dependencies for vulnerabilities anyway.
Incorrect. Vendoring done right (via replace-with, as done by cargo vendor) is not mutually exclusive with the rest of the tooling. You can have both.
Replies (1)
-
@Ferk@lemmy.ml 2026-10-26 19:38
True. But you still need to configure cargo there, the vendoring he’s talking about is one where cargo is not used.