Fix vulnerabilities detected by Nexus IQ

Nexus IQ identifies vulnerable open-source components used in your application. When vulnerabilities are detected, update or replace the affected dependencies to maintain security compliance.

Example: Fix vulnerable npm dependencies

If your project uses npm packages, you can review and fix vulnerabilities using the npm audit tools.

1. Configure npm to use the Nexus proxy repository:

   npm config set registry=https://nexus.ship.gov.sg/repository/npm-proxy/

2. Install project dependencies.

   npm install

3. Review detected vulnerabilities.

   npm audit

4. Apply available fixes.

npm audit fix

Review dependency versions

Nexus IQ reports provide a Version Explorer that shows:

• affected versions
• safe versions
• recommended upgrade versions

Upgrade the dependency to a safe version whenever possible.

Things to know

• Vulnerabilities originate from open-source libraries, not necessarily your application code.
• Updating to the latest stable dependency version often resolves vulnerabilities.
• If a vulnerability cannot be fixed immediately, your organisation may choose to waive the policy violation according to internal security guidelines.

Related topics

• Run Nexus IQ scans
• View Nexus IQ scan results
• Troubleshoot Nexus IQ scans