Amount of CVEs nowadays is kind of madness and I'm wondering how you're all dealing with the updates? I know larger organizations are more structured in this regard - there's private dependencies registry with some kind of vetting process, so not everyone has to decide what version to take.
But what about smaller projects without private registry platform solution? How you go about updating your packages? Especially for projects without high frequency changes.
I'm genuinely curious. Is it just `npm update` or similar locally? or in the controlled environment (Github Actions)? Do you ask LLM to do the job for you? How you go about extending semver constraints?
From my personal experience, this takes an awful lot of time and attention:
1. I need to review all the CVEs (reported from the Dependabot for example)
2. Then collect all the patched versions and pray there's a patch for my major
3. If no, then go check changelog of everything I have to update.
4. Then I need to figure out what exactly I need to update in my project
5. Sometimes the change is awkwardly large or LLM is not enough to migrate (this is especially sensitive for the UI-related stuff)
6. Then proceed with updates. Sometimes, it would require to update other packages or override version
I'm curious how it works for others, especially for smaller companies
- Do you have dependencies update cadence?
- Are you leveraging any additional tools to make it easier?
- Do you have a process around what alerts to ignore?
Comments URL: https://news.ycombinator.com/item?id=50377668
Points: 2
# Comments: 0
