Hey folks! Just upgraded to the latest version of our SCA tool and noticed it's now flagging vulnerable dependencies *and* proactively suggesting alternative packages with fewer known issues. 🤯
Ran it on a sample Node.js service and the output was super actionable. Instead of just saying "lodash@4.17.15 has a prototype pollution vulnerability," it suggested switching to `lodash@4.17.21` and even provided a quick one-liner for the update. For a more severe case with an abandoned `express-validator` fork, it recommended moving to the actively maintained `validator.js` package.
Here's a snippet of what the report looked like in our pipeline logs:
```json
{
"vulnerability": "CVE-2021-23337",
"package": "lodash",
"currentVersion": "4.17.15",
"suggestedFix": "Upgrade to 4.17.21",
"command": "npm install lodash@4.17.21"
}
```
I think this is a game-changer for developer experience. It reduces the context-switching and research time when dealing with security alerts.
**My questions for the community:**
* Have you tried similar features in other SCA tools (like Snyk, Dependabot, etc.)? How accurate are the alternative suggestions?
* In a monorepo with intertwined dependencies, do these suggestions hold up, or do they sometimes break compatibility?
* Would you trust this enough to automate the PR creation, or is manual review still a must?
I'm leaning towards integrating this into our CI pipeline to auto-create draft PRs for dev review. Small wins! 🚀
Keep deploying!
Keep deploying!