[SEC-WG] Centralized CVE Tracking for Our Packages
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 30/100
- Issue type
- Feature
- Clarity
- Needs clarification
- Activity status
- Stale
- Tech stack
- github, github-actions
- Domain
- security
Research direction
Start by reviewing the linked CVE-tracking PoC and the examples of vulnerabilities in scope in docs/threat-model.md. Clarify whether the project wants a maintained CVE file, a GitHub Action, or both, then define the package coverage, update process, and acceptance criteria before implementation.
Written by the indexing model from the issue text.
Description
I’ve just created a PoC to pull in all the CVEs we have across all our packages. Here’s the script (https://gist.github.com/bjohansebas/91c1056fbad6968b4bd739d53ab53d57). It can still be improved and even turned into a GitHub Action, but before moving forward, what do you think about tracking our packages’ CVEs here?
With this, we could also improve the section at https://github.com/webpack/security-wg/blob/main/docs/threat-model.md#examples-of-vulnerabilities-in-scope by referencing this new file.
Result
Security Advisories
Total: 7
webpack
Total: 7
| Repository Name | Advisories |
|---|---|
| webpack | |
| webpack-dev-middleware | |
| webpack-dev-server | |
| webpack-bundle-analyzer |
- Dominant language
- No language data
- Stars
- 0
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from webpack/working-groups
-
tsc-agenda
Difficulty 5/5 Over a week Newbie friendliness 25/100
webpack/working-groups#10 ·
-
tsc-agenda
Difficulty 5/5 Over a week Newbie friendliness 30/100
webpack/working-groups#11 · 2 comments ·
-
tsc-agenda
Difficulty 5/5 Over a week Newbie friendliness 30/100
webpack/working-groups#12 · 2 comments ·
-
tsc-agenda
Difficulty 4/5 3-5 days Newbie friendliness 42/100
webpack/working-groups#13 · 1 comment ·
-
tsc-agenda
webpack/working-groups#2 · 8 comments · 1 reaction · 1 assignee ·
All issues in webpack/working-groups
Similar issues
-
documentation help wanted
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
AXERA-TECH/ax-llm#75 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
sympozium-ai/sympozium#627 ·
-
clawsweeper:needs-product-decision clawsweeper:no-new-fix-pr clawsweeper:source-repro impact:security impact:ux-friction issue-rating: 🦞 diamond lobster P2
Difficulty 2/5 1-3 hours Newbie friendliness 84/100