Fix NPM Vulnerabilities with NPM Overrides - Secure NOW!

preview_player
Показать описание
LATEST: Fix NPM Vulnerabilities with NPM Overrides in order to secure your Packages and Dependencies. This is an updated video to the one I released last year.

Previous NPM Overrides Video:

It's important to secure your NPM packages by ensuring you're using the latest, updated dependencies. Unfortunately some packages don't always update some of their dependencies which can open you up to vulnerabilities.

In this video I show you how to use NPM Overrides to make sure you're using the updated versions and your projects will be more secure.

This is part of an ongoing effort to help people learn to code. I use my DevWP WordPress Development Training Theme as a demonstration, but this will work with other projects as well.

Learn to Create a Custom WordPress Theme with DevWP:

Make sure to follow the steps closely and to always backup your projects.

#npm #nodejs #javascript
Рекомендации по теме
Комментарии
Автор

Thank you for such short and effective solution!

swamidhyananurag
Автор

Thanks You Saved My life
and earned a subscriber

aadeeshjain
Автор

literally saved 5 days of work. Thank you soo much!!

vivekiyer
Автор

hello, i followed your instructions, but i still have this message : ode_modules/ws
auto-reload-brunch <=2.2.0
Depends on vulnerable versions of ws


22 vulnerabilities (2 low, 6 moderate, 10 high, 4 critical)

Franck_Polla
Автор

Without npm update can we fix vulnerabilities

usunuse
Автор

Does overrides with npm packages work the same way with yarn?

PhilDiasPJD
Автор

but what about, when you keep these overrides? you fall behind eventually and it's quite labor intensive changing these overrides over and over...
What is a package stops in development? (maintainer quits, no ownership transfer.. abandoned lib in essence) If you remove it, it can lead to breakage of other things.. Yet, it's vulnerable.. using an alternative package, can also lead to breaks, since it might not support the needed elements or communicates differently (function names, class names etc, which would mean rewriting you logic code.)
Also, who audits this? and on what level? (security, stability, features, etc)

mr_don_key