A library your app uses has a published vulnerability (a CVE). What is the right response?
Options
- Ignore it while the app still works as expected
- Check if you are affected and update the library (Correct option)
- Delete the documentation of the affected library
- Rewrite the whole library yourself from scratch
Answer
Check whether you are affected and update to a patched version; keep dependencies scanned regularly
Why
Most applications are mostly third-party code. A CVE is a public ID for a known vulnerability, and attackers read those lists too.
Check if the vulnerable part is used, then upgrade to the fixed version and run your tests.
Automate it: tools like Dependabot, pip-audit or Snyk flag vulnerable dependencies in every pull request.
Remember
Known vulnerable dependency → update; scan dependencies automatically.