Security News
The Unpaid Backbone of Open Source: Solo Maintainers Face Increasing Security Demands
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
@snyk/protect
Advanced tools
Patch vulnerable code in your project's dependencies. This package is officially maintained by Snyk.
You don't typically need to add the @snyk/protect dependency manually. It'll be introduced when it's needed as part of Snyk's Fix PR service.
To enable patches in your Fix PRs:
Snyk will now include patches as part of its Fix PRs for your project.
If there's a patch available for a vulnerability in your project, the Fix PR:
patch
entry to your .snyk
file.@snyk/protect
to your package.json
's dependencies.@snyk/protect
to your package.json
's prepare
script. {
"name": "my-project",
"scripts": {
+ "prepare": "npm run snyk-protect",
+ "snyk-protect": "snyk-protect"
},
"dependencies": {
+ "@snyk/protect": "^1.657.0"
}
}
Now after you run npm install, @snyk/protect will automatically download each patch configured in your .snyk file and apply them to your installed dependencies.
snyk protect
to @snyk/protect
@snyk/protect
is a standalone replacement for snyk protect
. They both do the same job, however:
@snyk/protect
has zero dependencies.snyk
in your dependencies (which is a much larger package with many dependencies).If you already have Snyk Protect set up, you can migrate to @snyk/protect
by applying the following changes to your package.json
:
{
"name": "my-project",
"scripts": {
"prepare": "npm run snyk-protect",
- "snyk-protect": "snyk protect"
+ "snyk-protect": "snyk-protect"
},
"dependencies": {
- "snyk": "^1.500.0"
+ "@snyk/protect": "^1.657.0"
}
}
We have also created the @snyk/cli-protect-upgrade npx script which you can use to update your project automatically. To use it, cd
to the location containing the package.json to be updated and run:
npx @snyk/cli-protect-upgrade
Made with 💜 by Snyk
FAQs
Snyk protect library and utility
The npm package @snyk/protect receives a total of 26,111 weekly downloads. As such, @snyk/protect popularity was classified as popular.
We found that @snyk/protect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Solo open source maintainers face burnout and security challenges, with 60% unpaid and 60% considering quitting.
Security News
License exceptions modify the terms of open source licenses, impacting how software can be used, modified, and distributed. Developers should be aware of the legal implications of these exceptions.
Security News
A developer is accusing Tencent of violating the GPL by modifying a Python utility and changing its license to BSD, highlighting the importance of copyleft compliance.