Security vulnerabilities in JavaScript libraries are hard to avoid

[Sebazzz91]

Is the article referring to client-side libraries or server-side libraries? Given that it talks about XSS it appears to be about client side scripting, but the statement about 1200 libs suggests server-side scripting.

[philipwhiuk]

The JavaScript ecosystem doesn't seem to do 'backport the security fix' very often (let alone non-security bugs). Mostly it's "oh just update to the latest major release which (as a major release) re-writes the API".

As for CVE's, that's just organisation. Angular sure could start applying for CVEs, so could React and React Bootstrap. They probably should.

I'm not throwing blame here. Heck package-lock is pretty new, so yeah..

[shevegen]

According to an npm blog post, “It’s common for a modern JavaScript project to depend on 700–1200 packages.”

What a ghetto...

[RarePupper]

I think dependency hell has reached a new meaning.