google / google/osv-scanner

Guided Remediation support for npm peerDependencies

Open
#1,026 1 comment 0 reactions 1 assignee Claimed by @michaelkedar View on GitHub
backlog guided remediation
Dominant language
Go
Stars
11k
Forks
792
Avg merge
1d 20h
Merged PRs (30d)
48

Description

Currently, guided remediation does not consider peerDependencies when making patches, which can (often?) result in a proposed patch having incompatible peer dependencies, which is a resolution failure in npm.

This is mostly because the deps.dev resolver we use was based on npm version 6, which does not automatically install or verify peerDependencies. Currently, we use the `--legacy-peer-deps` flag to ignore the problems found in modern npm versions. Ideally the resolver should evaluate peers, since we're possibly missing some vulnerabilities from implicitly included. Though this needs a change on the deps.dev side of things.

Still, we'd need to detect and fix issues in patches affecting peerDependencies. This probably requires a step after resolution to check for peerDependencies among the direct dependencies, and update the peer package if the version constraints are not correctly satisfied, and re-resolve.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.