snyk-opensource-remediation

Snyk Open Source (SCA) Remediation

Overview

Snyk Open Source (Software Composition Analysis) scans package manifests and lock files to identify known vulnerabilities in dependencies. This skill provides ecosystem-specific upgrade workflows.

Upgrade Strategy

Priority Order

1. Patch versions (1.2.0 → 1.2.1) — Lowest risk, always safe
2. Minor versions (1.2.0 → 1.3.0) — Usually backward compatible
3. Major versions (1.0.0 → 2.0.0) — May break API, requires testing

Pre-Upgrade Checklist

• Existing tests pass
• Review changelog for breaking changes
• Check if fixed version exists
• Verify package is still maintained
• Plan rollback strategy if issues occur

Ecosystem-Specific Workflows

npm/yarn (Node.js)

Check for updates:

npm outdated
# or
yarn outdated

Upgrade single package:

# npm
npm install package@version
npm install package@latest

# yarn
yarn upgrade package@version
yarn upgrade package@latest

Regenerate lock file:

# npm
npm ci  # clean install with exact versions from lock file

# yarn
yarn install  # regenerate yarn.lock

Test after upgrade:

npm test

Commit:

git add package.json package-lock.json
git commit -m "fix(deps): upgrade package to X.Y.Z"

pip (Python)

Check for updates:

pip list --outdated

Upgrade single package:

# Update requirements.txt
pip install --upgrade package==version
pip freeze > requirements.txt

# Or use pip-tools (recommended)
pip-compile requirements.in

Install from requirements:

pip install -r requirements.txt

Test after upgrade:

pytest

Commit:

git add requirements.txt
git commit -m "fix(deps): upgrade package to X.Y.Z"

Maven (Java)

Check for updates:

mvn versions:display-dependency-updates

Upgrade in pom.xml:

<dependency>
    <groupId>com.example</groupId>
    <artifactId>package</artifactId>
    <version>1.2.3</version>  <!-- Updated version -->
</dependency>

Resolve and download:

mvn dependency:resolve

Test after upgrade:

mvn test

Commit:

git add pom.xml
git commit -m "fix(deps): upgrade package to X.Y.Z"

Go

Check for updates:

go list -u -m all

Upgrade package:

go get package@version
go get -u package  # latest

Clean unused dependencies:

go mod tidy

Test after upgrade:

go test ./...

Commit:

git add go.mod go.sum
git commit -m "fix(deps): upgrade package to X.Y.Z"

NuGet (.NET)

Check for updates:

dotnet outdated
# or use Visual Studio Package Manager

Upgrade in .csproj or packages.config:

<PackageReference Include="package" Version="1.2.3" />

Restore dependencies:

dotnet restore

Test after upgrade:

dotnet test

Commit:

git add *.csproj packages.config
git commit -m "fix(deps): upgrade package to X.Y.Z"

Handling Transitive Vulnerabilities

Transitive vulnerabilities are in dependencies of your dependencies.

Scenario 1: Direct Dependency Fix

myapp → framework v1.0.0 → vulnerable-lib v2.0.0

Solution: Upgrade framework to a version that includes vulnerable-lib v2.0.1+

npm install framework@latest
npm test

Scenario 2: Transitive Dependency Override

If upgrading the direct dependency doesn't work, override the transitive version.

npm (via package.json overrides):

{
  "overrides": {
    "vulnerable-lib": "2.0.1"
  }
}

pip (via constraints file):

# constraints.txt
vulnerable-lib==2.0.1

# Install with constraint
pip install -c constraints.txt -r requirements.txt

Maven (via dependency management):

<dependencyManagement>
    <dependencies>
        <dependency>
            <groupId>com.example</groupId>
            <artifactId>vulnerable-lib</artifactId>
            <version>2.0.1</version>
        </dependency>
    </dependencies>
</dependencyManagement>

Scenario 3: Stuck on Vulnerable Version

If you can't upgrade due to compatibility:

1. File an issue with the upstream maintainer
2. Use Snyk ignore with justification (temporary measure)
3. Consider alternative package that's actively maintained
4. Implement compensating controls (WAF, network restrictions, etc.)

Lock File Best Practices

Commit Lock Files

DO:

# Commit lock file
git add package-lock.json yarn.lock requirements.txt go.sum
git commit -m "update: lock file"

DON'T:

# Don't ignore lock files
# Remove from .gitignore

Regenerate Lock Files

When dependencies change:

# npm
npm ci

# yarn
yarn install

# pip
pip-compile
pip install -r requirements.txt

# Go
go mod tidy

# .NET
dotnet restore

Verification Checklist

After each upgrade:

• Build succeeds: npm build / go build / mvn compile
• Tests pass: npm test / pytest / mvn test / go test
• No new vulnerabilities introduced: snyk test --json
• Changelog reviewed for breaking changes
• Code still compiles/runs correctly
• Integration tests pass if applicable

Commit Message Convention

fix(deps): upgrade package from 1.0.0 to 1.1.0

Resolves SNYK-JS-PACKAGENAME-123456
Fixes CWE-XXX vulnerability in dependency

Changelog: Updated to fix security issue with password validation
Tests: All tests pass locally and in CI

Common Issues

Issue	Solution
"Package version X not found"	Check typo in package name/version
"Breaking API changes"	Downgrade or consider alternative package
"Peer dependency conflict"	Upgrade peer dependency or major version
"Transitive dependency stuck"	File upstream issue or use override
"Lock file merge conflicts"	Regenerate: npm ci / pip-compile / go mod tidy