search

zooniverse / designator

Smart task assignment system
2 stars 1 forks source link

lock the array ref to a known commit #124

Closed camallen closed 3 years ago

camallen commented 3 years ago

avoid possible supply chain attacks on the upstream repo master branch

camallen commented 3 years ago

This seems fine to me. Change seems small enough. I find it interesting that we use https://github.com/takscape/elixir-array package vs the more-maintained https://github.com/Qqwy/elixir-arrays.

It's a very good question - perhaps can switch to this package and remove the broken one / forked version we currently use.