Fork your dependencies, trim them to only your use case, never update unless it breaks for your users. I’ve been vocal about this for 10+ years. I’ve always said that updating is way riskier than latent bugs (which can be tracked and CVEs monitored).
If you are updating a dependency, it’s on you to analyze every single commit in the full transitive set of dependencies. If you dont see anything compelling, dont update!
I remember at HashiCorp once in awhile an engineer would try to update a dep or replace a DIY lib with an external one and id always ask “show me the commit we need.” Dont update for the sake of it.
Feeling pretty swell about this mentality with all the supply chain attacks happening.
GOOGLE BUILT A VULNERABILITY SCANNER AND OPEN-SOURCED IT
most devs ship code without knowing half their dependencies are ticking time bombs
osv-scanner fixes that
it scans your entire project lockfiles, containers, even vendored c/c++ code and maps every dependency against the https://t.co/RL01xkZSfY database
supports 11+ ecosystems. npm, pip, cargo, maven, go modules, gem. all of it.
the guided remediation feature is the real unlock... it doesn't just tell you what's broken.... it tells you exactly which version upgrades fix the most issues with the least risk
call analysis built in. so you only get alerts for vulnerable functions your code actually calls. no noise
works offline too. download the db once, scan without internet
one command to scan your whole directory:
osv-scanner scan source -r ./
https://t.co/tNCUiUwCob