security issues, security advisories, security updates how? about bower.github.io HOT 7 CLOSED

Unfortunately bower doesn't have special procedures for security updates. General guidelines apply.

from bower.github.io.

thanx for answering. what do you mean by general guidelines?
we're in 2015, how can such important basics be missing?
why should anyone use thirdparty stuff in production without security considerations?

from bower.github.io.

Just update frequently, and report security bugs directly to maintainers, instead of on public issue tracker.

What other steps would you like Bower to do?

from bower.github.io.

i do not have the time to upgrade daily and then test everything (and possibly fix). or is this the way all work with bower?

i'd like to have a way to get notified on security issues on (my installed) bower packages. think of it like the debian security-mailinglist. i install packages, and get notified on all security updates published, so i can react and see what packages and where i need to upgrade.

from bower.github.io.

I guess we can create mailing list for important announcements

from bower.github.io.

@toastbrotch Even with NPM, they don't issue security updates. At the time of writing this, you still have to depend on third-party audit modules or apps to notify of new releases.

Having said that, yes that is a feature that should be integrated into core, be it on Bower or NPM

from bower.github.io.

Npm has currently has many tools to check security status of packages (e.g. npm audit or online services like github security checks or snyk checks). We'll also publish CVE for critical security fixes. I've also added SECURITY.md to bower repository which tells to report security issues directly by e-mail. I hope it's enough.

from bower.github.io.