Released finding
When a Python project pins a library, the container recipe it keeps mostly installs what the pin names
Whether container recipes read the pinned file, with undecided cases kept visible.
Follow the connections
These are explicit references between records. The link itself does not establish support or intellectual influence.
Referenced by this record
- At the snapshots LH008 to LH010 timed, does a pinned repository keep a container recipe, and does that recipe install its Python requirements from the file that held the pin or lock, or resolve them afresh? study
- Pinned software moved to security fixes over weeks, a little faster after the release and again after the advisory, and neither drew most of the moves finding
- Pinned software moved faster to security fixes that said so in their notes, mostly by people in the days after the release, but no larger share moved before the advisory finding
- Does pinned software move sooner to a security fix that says so? Added up, it leans that way; library by library, we cannot tell finding
- Further down Python's download rankings, fewer libraries' new versions take half the downloads in two days finding
- Where does a software update go once it is released? finding
- Where does a software update go? investigation
Records that refer back here
Navigation summary checked against the retained record. A record being written does not by itself mean that its study or investigation has ended.