On Sunday, 14 June 2026 at 12:02:30 UTC, Luna wrote: > > That way the attack surface would be limited to just the > package management component instead of affecting the entire > system. Another countermeasure might be that "dub upgrade" never pulls packages that are less than 5 days old without an override switch.