3 ms·
If only it were so easy. Typically, you're not using these dependencies directly. You use something that uses them. And it's not compatible with the "secure"
by recursive 5y ago
If only it were so easy. Typically, you're not using these dependencies directly. You use something that uses them. And it's not compatible with the "secure" version.
- charcircuit 5y agoThis sounds like a bigger problem than whatever issues exist with npm audit. Security updates should not be hard to do. When a vulnerability drops that impacts you project severely it should be easy to get to a secure state. Having to deal with working with downstream projects or a secure version being incompatible sound like big problems with the ecosystem.
- inbx0 5y ago> vulnerability drops that impacts you project severely well if it's a regex ddos in build tooling, it doesn't "impact your project severly". That's the entire point of this thread
- charcircuit 5y agoI never said it did. I am saying that if it's hard to patch irrelevant issues it is also hard to patch relevant issues. The ideal would be it is easy to patch all issues so you can always just upgrade to a safe version.
- inbx0 5y agoSure, but that's not something you can fix at the ecosystem level, it requires effort from the package maintainers and/or researchers to backport these fixes to older versions. And if the fix requires effort from the maintainers that is not actually very benefical to anyone (i.e. the vulnerability does not actually impose a security risk) then we are back to the question if it's really worth it. The effort has just been moved from the consumer to the library author.
- recursive 5y agoJust because npm audit says something doesn't mean it has any impact at all. Most of its outputs are false positives.
- charcircuit 5y agoBut when it's not a false positive, when it actually impacts your project it should be easy to update.