Software supply chain security requires decisions rather than defaults

The article discusses the risks of blindly upgrading software and the opposite risk of staying on legacy versions, illustrating with a planted backdoor in specific xz-utils releases and a breaking lodash patch; it advocates backporting fixes, treating SBOMs as living baselines, and controlling change at the point of entry to avoid forced, risky upgrades.