Sitecore JSS NPM updates policy

[robmaas]

Description

A lot of packages used by different Sitecore JSS versions are outdated and sometimes even contain criticial security vulnerabilities.
(For example JSS still uses axios: 0.21.1)
I don't really ever see updates to referenced packages.

What is Sitecore's policy on this?
Shouldn't dependency/patch management and security vulnerabilities have one of the highest priorities and be evaluated continually?

We keep running into unpatchable security vulnerabilities due to (sometimes desperately) outdated packages referenced by Sitecore JSS.
All supported major versions should regularly receive updates, apart from additional updates in case of newly discovered security vulnerabilites.

Additional information

No response

[yavorsk]

Hi @robmaas,
we do security vulnerability audits, last one came with the 21.6 release and later than scheduled, apologies about that.
There are still some vulnerabilities left (mainly in dev dependencies) due to two reasons:

• vulnerabilities come from dependencies with latest versions;
• axios; please refer to this conversation for more details on why we have not updated it yet Please update axios #1343 (comment) ; moving forward, we are planing to remove axios altogether.

[robmaas]

Hi @yavorsk,
Thanks for your reply, and apologies for the late response.
Any ETA on the complete removal of axios and it what JSS version we can expect it?

[art-alexeyenko]

@robmaas My apologies for leaving you hanging like this. Unfortunately we don't have and ETA still, but it is still 100% the plan. Please be on the lookout - at this point the change should come earlier rather than later.