Teaching plan
Preparation and learning goals
Select one package manager and test the exported kit on classroom machines. Preinstall approved tooling; scanner installation may need native components and network access. The kit contains DEPENDENCY-BASICS.md, historical reference reports and provenance. Read the walkthrough and rubric before teaching.
Students need basic JavaScript and terminal familiarity. Teach the primer before interpreting reports: the supplied app, manifest versus lockfile, direct versus transitive dependencies, one annotated finding, an advisory and a reviewed version change. The objective is to explain and perform evidence-based dependency maintenance, not memorize scanner flags.
Suggested sequence
Allow 60 minutes after setup for prepared students. For students new to dependency security, add 15–20 minutes of primer discussion and allow 75–90 minutes overall. Adjust the pace to your students’ experience.
| Stage | Prepared-student time | Checkpoint |
|---|---|---|
| Inspect app and dependency tree | 10 min | Identify axios/lodash and explain the transitive path. |
| Scan and locate one finding | 10 min | Distinguish report completeness, packages and advisory IDs. |
| Investigate advisory/context | 10 min | Explain affected version versus demonstrated app exposure. |
| Review repair, test and inspect changes | 15 min | Preserve evidence and use the chosen manager. |
| Rescan | 10 min | Compare actual results without assuming a clean scan. |
| Explain | 5 min | State what the tests and scan do not establish. |
Primer readiness answers: functional tests check limited behavior, not all dependency vulnerabilities; follow-redirects is transitive; advisory IDs need not equal vulnerable-package count; incomplete scans need investigation, not a clean verdict.
Assessment and fallback
Use the submission's package/advisory evidence table and rubric. Accept alternative supported remediations and differing current advisory counts. For historical-report analysis, grade interpretation and proposed checks while marking execution unperformed. Release the reference solution for debrief. Never deploy the intentionally vulnerable app.