guest@websec ~ % npm audit
17 · Dependencies and CVEs
An app pulls in hundreds of libraries, all running with full power. When one gets a known hole, attackers start scanning within days.
Nobody updates your dependencies for you
When a library ships a security fix, nothing changes in our app until we update. Until then, the lockfile keeps installing the old, vulnerable version.
Run
bundler-audit and brakeman, turn on Dependabot, and stay on a Rails version that still gets security fixes.CVEs and advisories, briefly
- A CVE is just an ID for one known vulnerability.
- Advisory databases say which versions are affected.
- Severity scores help, but what matters is whether we actually use the broken code.
Updating safely: change as little as possible
Update just the broken package, not everything. A small change ships today; a big one turns into a week of fixing unrelated breakage.
| ecosystem | find vulnerable packages | update one package conservatively |
|---|---|---|
| Ruby / Bundler | bundle audit | bundle update --conservative rack |
| Node / npm | npm audit | npm update lodash or npm install lodash@4.17.21 |
| Node / pnpm, yarn | pnpm audit, yarn npm audit | pnpm update lodash, yarn up lodash |
| Python / pip | pip-audit | pip install -U "jinja2>=3.1.4" then re-freeze |
| Python / Poetry, uv | pip-audit | poetry update jinja2, uv lock --upgrade-package jinja2 |
| PHP / Composer | composer audit | composer update guzzlehttp/guzzle --with-dependencies |
| any | OSV-Scanner, Snyk, Trivy | Dependabot / Renovate open one PR per update |
Version ranges decide what "update" means
Versions go MAJOR.MINOR.PATCH. Patches fix bugs, majors may break things. Your version range decides how far an update can move:
Bundler's ~> 4.17 works like npm's ^4.17.
A dependency hygiene checklist
- Commit the lockfile.
- Automate it: Dependabot plus an audit step in CI.
- Follow Rails security announcements.
- Update little and often. A year behind is hard to patch in a hurry.
- Be picky about new gems. Watch for look-alike names.
- Install from the lockfile in CI and production.