Running SNYK scanning on my code base I find a number of HIGH vulnerabilities when I include the npm dev dependencies (e.g. running
SNYK -dev test --file=package.json).
Examples of vulnerabilities:
What are your take on fixing such issues in dev dependencies? Should they be fixed or simply ignored? And why - what are the good arguments?
How can I ensure that no traces (i.e. vulnerabilities) of the dev-marked code is found in the production code? Can I?
And what about insider threats?