问 HN：你们如何优先处理依赖更新？
1 分•作者: nrig•7 个月前
我维护着几个开源项目，依赖管理变得不堪重负。<p>Dependabot 每周会在我的仓库中创建 20-30 个 PR。大多数是小版本更新，但其中也埋藏着关键的安全问题。我发现自己要么忽略所有 PR（风险很高），要么花费数小时进行筛选（难以持续）。<p>问题在于：我无法很好地判断哪些是真正紧急的，哪些可以等待。<p>我尝试过的方法：
- 遵循 CVSS 评分 → 但“严重”并不意味着“在我的环境中可被利用”
- 自动合并补丁版本 → 错过了几个重要的安全修复
- 手动审查所有内容 → 每周需要 5-10 小时<p>我最近发现了 CISA 的 KEV 目录（已知被利用的漏洞），它标记了正在被实际利用的 CVE。这似乎比单独使用 CVSS 提供了更好的信号，但我很好奇：<p>1. 您如何决定哪些是真正紧急的？CVSS？EPSS？手动评估？<p>2. 您是否将“已过时但没有漏洞”的依赖项与“存在 CVE”的依赖项区别对待？<p>3. 对于那些使用 Dependabot/Renovate/Snyk 的人 - 你们的工作流程是什么？您会审查每个警报，还是找到了一个好的过滤系统？<p>我正在考虑构建一些东西来帮助解决这个问题（健康评分 + 基于利用的优先级排序），但想确保我没有仅仅在解决自己的奇怪问题。<p>什么对您有效？
查看原文
I maintain several open source projects and dependency management has become overwhelming.<p>Dependabot opens 20-30 PRs per week across my repos. Most are minor version bumps, but buried in there are actually critical security issues. I find myself either ignoring them all (risky) or spending hours triaging (unsustainable).<p>The problem: I don't have a good signal for what's actually urgent vs. what can wait.<p>What I've tried:
- Following CVSS scores → but "critical" doesn't mean "exploitable in my context"
- Auto-merging patch versions → missed a few important security fixes
- Manual review of everything → takes 5-10 hours/week<p>I recently discovered CISA's KEV catalog (Known Exploited Vulnerabilities) which flags CVEs that are actively being exploited in the wild. This seems like a better signal than CVSS alone, but I'm curious:<p>1. How do you decide what's actually urgent? CVSS? EPSS? Manual assessment?<p>2. Do you treat "outdated but not vulnerable" dependencies differently from "has CVEs"?<p>3. For those using Dependabot/Renovate/Snyk - what's your workflow? Do you review every alert or have you found a good filtering system?<p>I'm considering building something to help with this (health score + exploitation-based prioritization) but want to make sure I'm not just solving my own weird problem.<p>What's working for you?