fohrloop, 2 months ago #TIL when creating a python project, and using some==2.2.0 to "pin" your requirements isn't actually pinning them, as the package owner (or anyone with access) may upload version 2.2.0-1, 2.2.0-2, etc. which will match the "==2.2.0". https://www.youtube.com/watch?v=oGpyupM52IQ #python #pythonsecurity #security #pip
#TIL when creating a python project, and using some==2.2.0 to "pin" your requirements isn't actually pinning them, as the package owner (or anyone with access) may upload version 2.2.0-1, 2.2.0-2, etc. which will match the "==2.2.0".
https://www.youtube.com/watch?v=oGpyupM52IQ
#python #pythonsecurity #security #pip
