https://curasec.metacog.co.kr/tags/dependency-risk/Recent content in Dependency-Risk on CuraSecHugoen-usMon, 12 Oct 2026 20:16:55 +0000https://curasec.metacog.co.kr/insights/2026-10-12-curl-will-not-accept-vulnerability-reports-during-july-2026/Mon, 12 Oct 2026 20:16:55 +0000https://curasec.metacog.co.kr/insights/2026-10-12-curl-will-not-accept-vulnerability-reports-during-july-2026/<ul> <li><strong>Engineer — Learn:</strong> A reminder that widely-used open-source dependencies can have disclosure blackout windows; factor planned maintainer absences into your supply-chain risk posture when assessing how quickly critical fixes would arrive. The July window has passed, so no immediate action.</li> <li><strong>SOC/IR — Skip</strong></li> <li><strong>Leader — Learn:</strong> Illustrates a governance gap in open-source dependency risk: key maintainer unavailability can delay patch availability for critical libraries; worth noting when reviewing third-party software risk policy for OSS dependencies.</li> </ul>