security issues, security advisories, security updates how?

[toastbrotch]

to let bower run in a production environment how are security issues, security advisories, security updates handled, notified, ...? could not find any information to security at all....

[sheerun]

Unfortunately bower doesn't have special procedures for security updates. General guidelines apply.

[toastbrotch]

thanx for answering. what do you mean by general guidelines?
we're in 2015, how can such important basics be missing?
why should anyone use thirdparty stuff in production without security considerations?

[sheerun]

Just update frequently, and report security bugs directly to maintainers, instead of on public issue tracker.

What other steps would you like Bower to do?

[toastbrotch]

i do not have the time to upgrade daily and then test everything (and possibly fix). or is this the way all work with bower?

i'd like to have a way to get notified on security issues on (my installed) bower packages. think of it like the debian security-mailinglist. i install packages, and get notified on all security updates published, so i can react and see what packages and where i need to upgrade.

[sheerun]

I guess we can create mailing list for important announcements

[riyadhalnur]

@toastbrotch Even with NPM, they don't issue security updates. At the time of writing this, you still have to depend on third-party audit modules or apps to notify of new releases.

Having said that, yes that is a feature that should be integrated into core, be it on Bower or NPM

[sheerun]

Npm has currently has many tools to check security status of packages (e.g. npm audit or online services like github security checks or snyk checks). We'll also publish CVE for critical security fixes. I've also added SECURITY.md to bower repository which tells to report security issues directly by e-mail. I hope it's enough.