Instructor walkthrough

Expected starting state: axios 0.21.1 and lodash 4.17.20. All five reference scans were complete and reported 2 vulnerable packages. Both findings are direct. follow-redirects is a transitive dependency of axios, not a vulnerable finding in these captured starting reports.

The application calls lodash.countBy and axios.getUri; it never performs network I/O. The advisory conditions may concern methods or contexts not exercised here. Award credit for stating this limitation, not for claiming exploitation.

Open the selected examples//reports/before/scan.json. Use findings[].vulnerabilities[].id for the exact advisory pages and findings[].cves for aliases. Examples for investigation: axios CVE-2021-3749 / GHSA-cph5-m8f7-6c5x and lodash CVE-2021-23337 / GHSA-35jh-r3h4-6jhm. Verify current affected ranges at https://github.com/advisories/GHSA-cph5-m8f7-6c5x and https://github.com/advisories/GHSA-35jh-r3h4-6jhm rather than assuming one old patch fixes all current advisories.

Reference migration: axios 1.20.0, lodash 4.18.1. See each solution/REMEDIATION.md for the exact manager command. The scanner's lower targets are axios 0.34.0 and lodash 4.18.0 in the captured report; those alternatives are not the supplied tested solution. Explain the trade-off between minimizing change and moving to a modern major line.

The four tests pass in student and solution. Rescans of each supplied solution reported 0 findings. A major upgrade changes the dependency graph; don't compare only package counts. Ask students to identify the lockfile as the resolved version record.

For a live demonstration: install the student, run tests and scan, propose the fix, apply the selected solution command to a COPY, inspect the diff, run tests and scan again, and compare to the supplied solution. Keep the untouched student folder for future classes.