What is the most effective way to manage Open Source Vulnerabilities in a Software Supply Chain?

All answers to this question.

Moving beyond basic audits requires a dedicated SCA tool like Snyk. The beauty of Snyk is its "developer-first" approach; it doesn't just tell you there is a vulnerability, it often provides the specific version upgrade that fixes it and even opens a PR for you. For SBOMs, you can use the 'syft' or 'cyclonedx-cli' tools within your pipeline to generate a JSON/XML manifest of every dependency on every release. This is becoming a must-have for compliance. Sonatype is also excellent, especially if you have a massive enterprise footprint and need a private repository manager like Nexus to proxy and vet all external libraries.

   Answered 2024-01-05 by Jessica Thompson

Does your team have a clear policy on what to do when a vulnerability is found in a deep transitive dependency that you can't easily upgrade yourself?

   Answered 2024-01-07 by Susan Martinez

• That’s where it gets tricky, Susan. Usually, if a transitive dependency is vulnerable and there is no patch, we look for an alternative library or implement a "virtual patch" using a WAF. In some cases, if the vulnerable code path isn't actually reachable in our application, we document the risk and 'ignore' the alert in our SCA tool for 30 days. It’s all about risk management rather than just chasing zero vulnerabilities, which is almost impossible in modern JS.

     Commented 2024-01-08 by Joseph Allen

Start by integrating GitHub Advanced Security or GitLab’s built-in dependency scanning. It’s often already included in your license and covers the basics without adding more tools.

   Answered 2024-01-09 by Daniel Wright

• Daniel has a point. Before buying a third-party tool, check your git provider. GitHub's Dependabot is surprisingly effective for most standard vulnerabilities and requires almost zero configuration.

     Commented 2024-01-10 by Elizabeth Taylor