Tag: software-supply-chain
-
Google can update third party open source dependencies in two hours or so, but forked code takes much longer.
But, forks take longer: On predictors: custom patches matter most. Packages Google had patched took three times longer at the median than unpatched ones, and “Google-specific patches or customization” was also the single most-cited reason engineers gave for a slow update. Volume of external dependencies, package size, and upstream change velocity tracked effort as well,…