<![CDATA[Maintaining modules - security updates]]>Hi everyone,

As a developer/maintainer of a couple of MM modules I’m really wondering how everyone is keeping their modules’ dependencies up to date.

An easy thing to do would be to run npm audit fix on my repos and/or merge all PRs from dependabot, but I’m too worried about breaking changes in dependencies. I wouldn’t know how to find the time to extensively test and fix all functionality in the modules. Especially if it would break functionality that someone else is using, that I’m not myself.

How do other developer handle this?

Chris

]]>https://forum.magicmirror.builders/topic/17576/maintaining-modules-security-updatesRSS for NodeTue, 15 Sep 2026 02:42:01 GMTFri, 27 Jan 2023 10:31:41 GMT60<![CDATA[Reply to Maintaining modules - security updates on Sat, 18 Feb 2023 13:37:17 GMT]]>@qistoph we don’t have any binaries, all our code is in JavaScript. we are exposed to the general internet trends, speed of delivery over stability

breaking changes are everywhere.

I will say that a couple volunteers have been are working hard on processes for mm to detect those breaking changes by implementing a test system . but nothing is perfect

]]>https://forum.magicmirror.builders/post/107940https://forum.magicmirror.builders/post/107940Sat, 18 Feb 2023 13:37:17 GMT<![CDATA[Reply to Maintaining modules - security updates on Sat, 18 Feb 2023 06:53:12 GMT]]>Would’ve been nice if there were (at least a couple) basic libs with long time support. Security fixes, maybe some added functionality now and then, but no breaking changes…

The actual risk of almost all vulnerabilities is quite low indeed because of the way our systems are setup. It’s just the earie feeling of seeing all these critical issues while installing my modules that doesn’t feel right.

]]>https://forum.magicmirror.builders/post/107939https://forum.magicmirror.builders/post/107939Sat, 18 Feb 2023 06:53:12 GMT<![CDATA[Reply to Maintaining modules - security updates on Fri, 27 Jan 2023 23:20:03 GMT]]>@qistoph I’m moving the stuff I do to no dependencies. :)

]]>https://forum.magicmirror.builders/post/107580https://forum.magicmirror.builders/post/107580Fri, 27 Jan 2023 23:20:03 GMT<![CDATA[Reply to Maintaining modules - security updates on Fri, 27 Jan 2023 12:38:23 GMT]]>@qistoph sadly there is no magic. all of them lead to testing

audit fix causes more problems than it resolves. cause of unseen breaking changes.

one of my (not published) modules gets it’s data from a mongob db somewhere remote. the server version changed, and dropped support for my (admittedly old) client version. one function I used was an external add on, now part of the product… BUT done differently… so you get to rewrite sometimes… it’s crushing…

from a security standpoint, we are not a general purpose web site w lots of different users trying to use it at the same time

]]>https://forum.magicmirror.builders/post/107578https://forum.magicmirror.builders/post/107578Fri, 27 Jan 2023 12:38:23 GMT