What's the risk of a supply chain attack on Bisq?

[Conza88]

https://twitter.com/jamesob/status/1360065911277957122

[ripcurlx]

This isn't an immediate issue for us as we are first not auto-updating dependencies and all dependencies that are resolved are compared to a hash to prevent any changes when they are resolved. It would be something to look for when we update libraries and update hashes for new versions.