In some cases, we should also prioritize release and update of affected packages in their consumers in order to mitigate the security issues, based on their EPSS value.
When to release the package
if EPSS is >= 1% then release the package and deliver to clients
if EPSS is < 1%
if the package is released (and delivered to clients) frequently then just merge the dependabot PR
if the package is rarely updated, release and deliver to (at least) other packages that are released more frequently, or to clients if it makes sense
There are several PR related to security vulnerabilities from dependabot in repos owned by Wallet Framework (for full list, see https://github.com/MetaMask/MetaMask-planning/issues/3540).
In some cases, we should also prioritize release and update of affected packages in their consumers in order to mitigate the security issues, based on their
EPSSvalue.When to release the package
EPSSis >= 1% then release the package and deliver to clientsEPSSis < 1%To get the
EPSSvalueEPSSright belowGHSA ID@mikesposito
@mcmire
@MajorLift
@mcmire