Software Supply Chain Security Requires Deliberate Upgrade Decisions
Summary
The article argues teams should evaluate and pin software dependencies, maintain trusted baselines, and backport targeted fixes rather than blindly upgrading, citing the xz-utils backdoor and a faulty lodash release as risks of default update policies.
Key points
- The article says the xz-utils backdoor affected releases 5.6.0 and 5.6.1, while the older 5.4.x line was not exposed; it says CISA advised downgrading.
- It recommends evaluating packages and container images before they enter an environment and documenting why particular versions are used.
- The article warns that upgrades can bring changes beyond a security fix, including transitive dependencies, defaults, and code paths.
- It describes lodash 4.18.0 as a faulty security release that was deprecated after a packaging mistake; it says the fix arrived in 4.18.1.
- Backporting a targeted fix can address a vulnerability without requiring an upgrade that changes other components.
- The article recommends maintaining an SBOM as a current, governed software baseline and checking it against new disclosures.
Article Details
- Topic
- Software supply-chain security decisions, including package evaluation, version pinning, backporting, and maintaining an SBOM
Vendors
Products
Aikido LibrariesStaying on a version shouldn't mean staying exposed. Aikido Libraries backports the fix to the version you're already running, no forced upgrade, no forced migration. Start patching here.LodashMost of the time that risk is invisible and nothing goes wrong. But, and it’s a big but, it can go wrong. lodash spent a stretch of 2026 with a disclosed arbitrary code injection vulnerability affecting every publishedxz-utilsAnd that instinct has backfired badly in the past. A backdoor sat inside two specific releases of xz-utils, versions 5.6.0 and 5.6.1, planted by an infiltrator who’d spent two to three years plotting up release