2. Vulnerable Dependencies

[jomm2]

Select Topic Area

Question

Body

If GitHub Dependabot alerts us to a critical vulnerability in a package (e.g., express-session or a payment gateway SDK), how should we respond?
What’s the safest way to verify, patch, and deploy fixes without breaking the live bus booking service?

[Jomm31]

When GitHub Dependabot flags a critical vulnerability, our first priority is to verify, patch, and deploy safely without disrupting the Bus Website System’s live service.

Verify the Vulnerability Alert

Review the Dependabot advisory to confirm the affected version, severity, and impact.

Check whether the vulnerable package (e.g., express-session) is actually used in our code path or only as a transitive dependency.

Reproduce or test locally to ensure it’s not a false positive.

Isolate and Test the Fix

Create a separate branch (e.g., security/fix-express-session) for the update.

Run npm audit or npm ls to confirm which dependencies are affected.

Apply the recommended patch using npm audit fix or manually update the package version in package.json.

Rebuild and test the system locally or in a staging environment to confirm that the fix does not break authentication, booking, or payment features.

Use a Controlled Deployment Process

Deploy the patched version first to the staging server that mirrors production data and environment settings.

Run automated unit, integration, and regression tests — especially for login, route searching, and booking transactions.

Only after successful validation, merge the branch into main and allow GitHub Actions CI/CD to deploy to production.

Ensure Safe Supply Chain Management

Lock the updated versions in the package-lock.json file for deterministic builds.

Use signed commits and verify package publishers to prevent dependency hijacking.

Regularly review all dependencies using npm audit, Dependabot alerts, or SCA tools like Snyk.

Post-Fix Actions

Document the fix in the security changelog and update the SBOM (Software Bill of Materials).

Monitor application logs and alerts for abnormal behavior after deployment.