Operation Rosehub – patching thousands of open-source projects
If I understand it right, this bug involves code pulling in old buggy libraries, sometimes indirectly via other libraries. It seems that there is a reference to a specific bad version, not the actual inclusion of cut-and-paste code.<p>Eh, why not just get rid of the bad version? Alternately, release a bug-fixed copy with the same version number.<p>Any breakage is a case of &quot;oh well, you&#x27;re safe now&quot;. Leaving the security hole is probably worse breakage.