Security

Vendored Dependency

A vendored dependency is third-party code copied into a project's own source tree or package instead of loaded from a shared system library. It pins a known version, but each vendored copy needs its own update when the original library is patched.

Deep dive

Learn Article

Why Patching Bundled Libraries Takes More Than One Update

Why patching bundled libraries is slow: every product ships its own copy and its own fix. How to plan around it, using the Brotli flaw as the example.

intermediate 4 min read

Back to glossary