ranade-oss puts guardrails around its software supply chain

ranade-oss has changed how it scans third-party software for known security issues, adding retries when the check cannot get a clean answer. That reduces the chance that a temporary service failure is mistaken for a clean bill of health.

The more consequential move happens during installation: the fork patches a vulnerable legacy dependency inside the installed software, then tests that the patch actually works and stops the process if it does not. It is a pragmatic short-term fix, but a brittle one. Future package updates could break it. The fork also standardises the version of the underlying runtime used across its automated deployment checks.