2 posts tagged with "Node.js"

I've been fixing quite a few package CVEs in Node.js projects at work lately, so I wanted to write down the decision process while it's still fresh. The first time I saw CVEs, Fixed Version fields, and long node_modules paths in a scan report, all I knew was “some packages need upgrading.” I had no idea how to go about it. For the first few fixes, I kept looking things up and asking AI for help. After working through several dependency setups, I started to see the pattern: fixing Node.js package vulnerabilities means reading the dependency tree, checking version ranges, and choosing the smallest safe change. The options differ considerably depending on whether the vulnerable package is a direct dependency, a transitive dependency, pinned to an exact version, or no longer maintained. I'll walk through the situations I've encountered and worked through, so you can see the reasoning behind each decision.

A bit of background:
I recently got assigned a feature to build on a Koa backend at work. Most of my day-to-day work is on the frontend, but I'd used Express a little as a student. Since both are well-known Node.js web frameworks, the code didn't feel entirely unfamiliar. They have plenty in common, but working with Koa showed me just how different their design choices and day-to-day experience can be.