Can we discuss why so many dependencies are pinned?

[catdad]

I know that nx's own direct dependencies got pinned recently in #35159 because of the axios fiasco. However, this has meant that projects that use nx now must install these exact dependencies, preventing them from updating them.

Currently, the latest nx version is 22.7.1 and has at least 13 security vulnerabilities (probably more, sorry I did not pull an exhaustive list). These have been identified for over a week without a fix to nx.

References:

• The built version of nx has vulnerable pinned versions #35536
• Axios set to 1.15.0 in v22.7.1 #35636
• fix(core): bump axios to 1.16.0 for all packages #35568

We have SLAs we need to meet and security audits we need to pass, and nx is currently directly in the way of us being able to do that. With pinned dependencies, our only options are to wait or to drop nx entirely. Hardening the project is a noble idea, but this implementation leaves us more vulnerable rather than less. Pinning dependencies also requires strict commitments to meet the release cadence of all pinned dependencies combined. Otherwise, users are left in a really difficult position.

[alfaproject]

Every package manager support overrides and we are using those, but I agree with you.

[catdad]

Overrides are definitely one of the options, though a difficult one. In previous sizeable projects I've worked on that rely on overrides, we end up with a list of thousands of overrides, and no one knows which ones are vital to the project and which ones are security overrides that you can delete in a month or two. It grew out of hand and turned automated dependabot/renovate updates into hour-long investigations for every single dependency. While they work, and we do use them sparingly now as well, I just really don't want overrides to be my go-to strategy for every dependency update -- they are more of a last resort.

[danleyden]

Locking the dependencies in this way causes a major headache.

Accepting that it was done with the best of intentions, the effect is that every time a direct dependency like Axios has a major CVE uncovered and a new version released we now have to wait for a release and update nx to latest.

This means that we're forced to accept any other fixes, bugs or changes in other dependencies that nx updates at the same time, which massively increases the scope of what we need to evaluate and test in order to fix a CVE in one dependency. That can turn a 5-minute task into hours...

Overrides in the package manager could be used as suggested by @alfaproject, but that also adds significant complexity to managing the tool chain.

In a world where SLAs and security audits (rightly) happen, we have a requirement to assess, triage and fix issues within a short time window. Pins on versions for non-functional reasons means that we're now reliant on a third party project performing a release to meet our SLA.