Remember the XZ Utils backdoor this year?
In the last <a href="https://www.cvedetails.com/" target="_blank" rel="noopener nofollow">30 days there were 3351 CVEs created, 6163 CVEs updated</a>.
<a href="https://www.synopsys.com/software-integrity/resources/analyst-reports/open-source-security-risk-analysis.html#introMenu" target="_blank" rel="noopener nofollow">There’s research on this topic.</a> 84% of 1,703 reviewed codebases had at least one such vulnerability.
<a href="https://arxiv.org/pdf/1811.00918" target="_blank" rel="noopener nofollow">An older 2017 study</a>, 37% of websites used outdated JavaScript libraries with known vulnerabilities.
You have to keep up. Breaches do happen. Think the big <a href="https://www.csoonline.com/article/567833/equifax-data-breach-faq-what-happened-who-was-affected-what-was-the-impact.html" target="_blank" rel="noopener nofollow">Equifax data breach in 2017</a> and some lesser known ones like <a href="https://www.papercut.com/blog/news/security-post-incident-report-april-2023/" target="_blank" rel="noopener nofollow">PapercutNG incident in 2023</a>.
But keeping up is hard. New vulnerabilities appear daily, old vulnerabilities are patched, but codebases don’t update to the newest version.
If you pulled Lodash <code>4.17.20</code> into your project 3 years ago, which is a set and forget type of dependency, you probably missed a critical vulnerability fix two years ago.
If your <code>package.json</code> still has this version of Lodash, your code is vulnerable.
There is a better way. You can <a href="https://trunk.io/blog/shifting-security-left-with-trunk-check" target="_blank" rel="noopener nofollow">shift security left</a>.
Shifting left means using tools like <a href="https://github.com/google/osv-scanner" target="_blank" rel="noopener nofollow">OSV Scanner</a> to look for vulnerable packages and <a href="https://github.com/trufflesecurity/trufflehog" target="_blank" rel="noopener nofollow">trufflehog</a> to find leaked secrets.
It means checking your IaC with <a href="https://trunk.io/linters/security/checkov" target="_blank" rel="noopener nofollow">checkov</a>, it means securing containers with <a href="https://trunk.io/linters/security/trivy" target="_blank" rel="noopener nofollow">Trivy</a>
It means It means using static analysis tools like Snyk and Sonarqube.
It means catching stuff before committing and before merging.
Friendly reminder to scan your deps!
<hr>
This is a self-promo :)
If you want to have suggested static analysis tools, standardized output, tested known good configs and good versions, run them with <a href="https://docs.trunk.io/check/usage" target="_blank" rel="noopener nofollow">Trunk Check</a>.

Hi, Trunk makes developer tools to solve problems developers hate.

But we also love sharing about what we learn along the way as we speak to engineering leaders!

Trunk.io

In the last 30 days, 3351 new CVEs were created and 6163 were updated. Many codebases have vulnerabilities due to outdated dependencies, such as an old version of Lodash. To mitigate risks, consider shifting security left with tools like OSV Scanner, trufflehog, checkov, and Trivy. Proactive static analysis tools like Snyk and Sonarqube can help catch issues before they affect your codebase. Regularly scan your dependencies to ensure security.

3351 new vulnerabilities discovered in the last 30 days.

A lot, with growing amount of software these numbers are only going to increase. After noticing this I immediately integrated Docker images scanning into my CI (wrote about it here if anyone is interested - <a href="https://packagemain.tech/p/identifying-container-image-vulnerabilities" target="_blank" rel="noopener nofollow">https://packagemain.tech/p/identifying-container-image-vulnerabilities</a>)

Interesting!
Yes, updating your libs is a good thing, but browsers and server stuff should also follow! I saw a client using a bad and old browser, 5 years late for updates…
As for updating libs regularly, and fight against technical debt, this is exactly where I think AI could, in the future, be a great help. We don’t necessarily need AI to craft a new project, but you can’t say “we don’t need this” without thinking if you have things you should do but can’t find the time (aka updates, documentations, tests/scans and reviews…)