6 ms·
> running few years old JS deps What do you when a critical vulnerability gets discovered and you have to update a package? How many critical/high severity vul
by crab_galaxy 4mo ago
> running few years old JS deps
What do you when a critical vulnerability gets discovered and you have to update a package? How many critical/high severity vulnerabilities are you running with in production every day to avoid supply chain attacks?
- throawayonthe 4mo agothey said internal dashboards
- nine_k 4mo agoAnyone who gets into the security perimeter may be in for a feast then.
- devttyeu 4mo agoFor the stuff in more sensitive deployments it's really quite simple, just setup CORS etc properly and don't do anything overly fancy on the frontend. Worst case the user may force some internal function to eval some JS by pasting scripts into the browsers debug console. Critical severity vulnerabilities are only critical when they are reachable, but are completely meaningless if your application doesn't touch that code at all. It's objectively more risky to "patch" those by updating dependencies than just let them be there.