Adding a vulnerability scanner as part of the dependency updates #59911

Activity

1. mcollina commented on Sep 17, 2025

   

   mcollina

   on Sep 17, 2025

   SponsorMemberAuthor

   More actions

   cc @nodejs/security-wg @lirantal @feross
2. joyeecheung commented on Sep 17, 2025

   

   joyeecheung

   on Sep 17, 2025

   Last edited by joyeecheung

   Member

   More actions

   Not sure how well existing tools cover this but we also need to make sure there isn't a TOCTOU problem. e.g. if the bot opens a PR to update to a vulnerable dependency and a few hours later people discovered that there's malicious code in the updated version, there should be some updates in the PR to remind the reviewers.

   Also it would be safer to keep the dependency update PRs open for a while, e.g. so that there's a >7 day period since the publish date of the newest updated dependency.
3. joyeecheung

   added

   toolsIssues and PRs related to the tools directory.Issues and PRs related to the tools directory.

   securityIssues and PRs related to security.Issues and PRs related to security.

   on Sep 17, 2025
4. richardlau commented on Sep 17, 2025

   

   richardlau

   on Sep 17, 2025

   Member

   More actions

   If we want to wait on updates we could pass --before to npm install in the update scripts.

   👍React with 👍2Reacted by Ruben Bridgewater and Joyee Cheung
5. BridgeAR commented on Sep 17, 2025

   

   BridgeAR

   on Sep 17, 2025

   Member

   More actions

   If we want to wait on updates we could pass --before to npm install in the update scripts.

   I think that is a good idea. We should have a couple of days before we pull in updates. I think three days would make sense.
6. aduh95 commented on Sep 17, 2025

   

   aduh95

   on Sep 17, 2025

   Contributor

   More actions

   Dependabot has a cooldown option that we could use if we’re not already
7. mcollina commented on Sep 17, 2025

   

   mcollina

   on Sep 17, 2025

   SponsorMemberAuthor

   More actions

   @RafaelGSS do you think this is an activity that can be part of the AlphaOmega grant?
8. RafaelGSS commented on Sep 17, 2025

   

   RafaelGSS

   on Sep 17, 2025

   Member

   More actions

   @RafaelGSS do you think this is an activity that can be part of the AlphaOmega grant?

   Sure. I'm just a bit more restricted in time than I was before, but I can take a look on this.

   I think the --before (or cooldown option) would prevent us to fall in those recent supply chain attacks, but we'll need to monitor closely in case of security fixes to dependencies as they will get delayed to be merged on main.

   👍React with 👍1Reacted by Matteo Collina
9. RafaelGSS

   added a commit that references this issue on Sep 22, 2025

   tools: use dependabot cooldown and move tools/doc

   ...

   6efef83
10. lirantal commented on Sep 24, 2025

    

    lirantal

    on Sep 24, 2025

    Member

    More actions

    I can speak for the Snyk capabilities:

    • can be integrated via the SCM integration which then creates PR checks for security (SCM and SAST) so yes dependencies are part of it
    • not sure if it's widely known but Snyk automates dependency updates as well through PRs like dependabot etc and has a built-in mechanism we added back in 2019 or so with a delay (what has been pointed above as "cooldown"), from the docs:

      Snyk does not recommend upgrades to versions that are less than 21 days old. This is to avoid versions that introduce functional bugs and are subsequently unpublished or versions that are released from a compromised account, an account for which the account owner has lost control to someone with malicious intent.

    • RE TOCTOU malware - I'm checking with the product about Snyk's approach to this
    • It would be cool to enrich package dependency results from Snyk Advisor (whether directly through Snyk in some way, or through some kind of integration, for example, I created a while back the Dependency Advisor GitHub Action)

    Also I've been trying to raise awareness to npq as an npm wrapper that runs on the dev's machine and proactively runs heuristics and checks prior to installing packages (would've caught many past security incidents and avoid devs falling for them).

    Happy to learn if any of the above or other measures would be useful.
11. RafaelGSS commented on Sep 24, 2025

    

    RafaelGSS

    on Sep 24, 2025

    Member

    More actions

    I'd love to hear more about that. Is it possible for you to join any of our security-wg meetings? @lirantal

    👍React with 👍1Reacted by Matteo Collina
12. nodejs-github-bot

    added a commit that references this issue on Sep 30, 2025

    tools: use dependabot cooldown and move tools/doc

    ...

    1d49478
13. targos

    added a commit that references this issue on Oct 6, 2025

    tools: use dependabot cooldown and move tools/doc

    ...

    20d10a2
14. aduh95

    added a commit that references this issue on Oct 22, 2025

    tools: use dependabot cooldown and move tools/doc

    ...

    9fae03c
15. github-actions commented on Apr 23, 2026

    

    github-actionsbot

    on Apr 23, 2026 – with GitHub Actions

    Contributor

    More actions

    This issue has been marked as stale due to 210 days of inactivity.
    It will be automatically closed in 30 days if no further activity occurs. If this is still relevant, please leave a comment or update it to keep it open.
16. github-actions

    added

    staleIssues and PRs marked stale due to inactivity and scheduled for automatic closure.Issues and PRs marked stale due to inactivity and scheduled for automatic closure.

    on Apr 23, 2026
17. github-actions commented on May 23, 2026

    

    github-actionsbot

    on May 23, 2026 – with GitHub Actions

    Contributor

    More actions

    This issue has been automatically closed after 30 days of inactivity following its stale status (no activity for a total of 240 days).
    If this is still relevant, feel free to reopen it or leave a comment with additional details so we can continue the discussion.
18. github-actions

    closed this as not plannedon May 23, 2026