Github security advisory

[ralphonz]

Hi all,

I’ve been wondering, whats the best way to fix GitHub security advisories on a sage project? I don’t even know what most of them are for, they are all nom packages. How does one go about updating the packages in a sage project to address the security issues?

[alwaysblank]

In a vanilla Sage install you can probably safely ignore most of them: Sage out-of-the-box uses 90% of the npm packages it installs for the build process, and most security issues that GitHub flags have to do with scripts that are out in the wild interacting with users and servers–things the Sage scripts will never do.

Usually the security advisories will give you some advice on how to address them, i.e. “Update Script X to at least version 2.3.5” so you can always do that–frequently (IME) the packages in question have released a bugfix update to address the issue, so you don’t need to worry too much about them breaking anything. If it’s something deep in the dependency tree that may be harder. IIRC though the advisories will also usually tell you what the security problem with the script is, and you can evaluate whether or not that vulnerability is actually applicable to your use case.

[ralphonz]

Thanks for the response! Thats very helpful.

Let’s say I want to update a script (one thats included in a vanilla sage install), whats the best way to do that?

[strarsis]

I recently made a little guide for this:

Updating the Sage 9 webpack config

First you may want to sync the package versions and webpack configs of latest commit in sage 9 branch. If you have already done that and for further updating, see this guide: So this is how I am updating (or have updated) sage 9 projects (this can be used for other types of projects as well): Your project should already be under version control, create a new update branch if you like to make the process cleaner. Run the david tool for a table of updateable dependencies. Note that a change in…

[ralphonz]

Thats perfect thank you.