This is a great article!! Thanks Yogesh Chavan.
I have two questions
Is it necessary to run audit can't we skip vulnerabilities? what will be the worst case scenario if we skip it.
Will updating the node itself cause any issues in existing projects? given that it is a major update.
Context : I have v20.13.1 and I want to update but not sure if doing so will break my existing projects.
Could you please guide me on this?
You should always try to fix all the vulnerabilities when you want to keep your application secure.
Vulnerable dependencies can lead to real-world exploits such as:
Remote code execution
Data leaks
Denial of service (DoS)
By running audits, you're proactively reducing the risk of these issues in your application.
You should at-least fix the high severity vulnerabilities.
You should always check your current project node version, and each of the above nodejs version changelog if there is any breaking change before updating to the latest.
So If your current Node.js version is 17, you should read all the changelog of version 18, 10 and 20 If you want to update to 20 to see if there is any breaking change, and gradually update your project version to 18 first, then 19 and then 20 to see if anything breaks.