阅读中文版本

Dependency Vulnerability Response Workflow

Triage a new dependency advisory, assess reachability, and patch or mitigate within the agreed time window.

Overview

Respond to dependency advisories promptly with reachability-aware remediation.

This workflow is reusable across teams and environments; adapt the commands to your tooling while keeping the sequence and checkpoints intact.

Environment and prerequisites

• A dependency scanner
• SBOM or lockfiles
• Reachability analysis

Procedure

1. Assess the advisory

Determine affected versions, exploit conditions, and severity from the advisory.

Expected state: The blast radius of the advisory is understood.

2. Check reachability

Determine whether the vulnerable code path is actually used in your application.

Expected state: You know if you are genuinely exposed.

3. Patch or mitigate

Upgrade to a fixed version or apply a compensating control where no fix exists.

Expected state: Exposure is removed or reduced.

4. Verify and record

Rescan to confirm the finding is gone and record the disposition.

Expected state: The advisory is closed with evidence.

npm ls lodash
npm audit --json | jq '.vulnerabilities[] | select(.severity=="high")'

Verification

Confirm the rescan no longer reports the finding and the disposition is recorded with a fix version or mitigation.

Decision points

Patch on any finding or only reachable ones?

• Prioritize reachable, high severity
• Patch every advisory

Recommendation: Prioritize reachable and severe findings; track the rest without panic.

Upgrade immediately or wait for a staged rollout?

• Patch critical immediately
• Wait for the normal cycle

Recommendation: Patch critical, reachable findings immediately; batch the rest.

Common failures

• Panic-patching everything wastes effort.
• Ignoring reachability misses real exposure.
• No disposition record loses the decision trail.