Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Unless the framework backports fixes (both bugs and CVEs) to the major version line you're using, you're forced to upgrade the framework to a newer major version line for the framework's sake, not the "build tools". And that upgrade will bring in all the other API changes that have happened in the new major version line.


The ExtJS codebase suffered from this problem, and this was solved by patching the ExtJS version ourselves to fix bugs as they were found (security issues and browser bugs). At first we would do minor upgrades of ExtJS and bring the patch file along to the new version, stripping out the fixes no longer needed, but when ExtJS 3 stopped getting new releases we just kept fixing the last 3.x version.

Of course, it would be better if this were solved at the framework level by having them ship LTS releases that could keep getting fixes at the framework level for many years and had no build tool dependencies. But this is not a hard requirement to going this route.


Are there CVEs in web UI frameworks?


Of course.



>vue can't find

React's CVE-2018-6341 also affected Vue.

It'd be quite unusual for any big UI library to not have an XSS issue at some point in its life :)




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: