rendertron
rendertron copied to clipboard
Upgraded everything to the latest (packages, puppeteer, node, etc)
This PR covers the following to bring rendertron to the latest in terms of dependencies, puppeteer, node versions, etc.
Upgrades/Changes:
- Upgraded all the dependencies to their latest versions. See package.json
- Addressed compatibility issues (e.g. typescript types) within rendertron code to use the latest packages
- Node v10 is outdated and no longer maintained. Similarly node v12 is EOL in 04/22. So upgraded packages using current node version (v16) and updated actions to test on v14, v16 & v17. See https://nodejs.org/en/about/releases/
- Puppeteer upgraded to 10.4.0
- Used the fix from PR #694 for tests failing due to google-cloud SDK. Credit: @dwsmart for PR #694.
Tests:
- Tests all seem to pass. Also tried the CI actions on my personal repo to make sure it passed (see https://github.com/gravi2/rendertron/actions/runs/1379045134)
- Tested few websites to make sure the filesystem and memory cache worked.
I am looking for community to try this PR/branch and report any improvements/issues/etc compared to the current master.
Hi @gravi2 , I ran on your PR branch for about 1 month now (from #761) , so far seem ok, dont have crash or some random failed to render issue. I got turn on closeBrowser config because it return 0kb empty response when rendering, after turn on and it is working fine d. I saw the solution somewhere in one of the issue in this repo before.
git clone https://github.com/GoogleChrome/rendertron.git followed by
git pull origin pull/813/head
correct?
I get:
13 vulnerabilities (7 moderate, 5 high, 1 critical)
After audit fix
npm audit fix
# npm audit report
got <11.8.5
Severity: moderate
Got allows a redirect to a UNIX socket - https://github.com/advisories/GHSA-pfrx-2q88-qq97
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/got
package-json <=6.5.0
Depends on vulnerable versions of got
node_modules/package-json
latest-version 0.2.0 - 5.1.0
Depends on vulnerable versions of package-json
node_modules/latest-version
update-notifier 0.2.0 - 5.1.0
Depends on vulnerable versions of latest-version
node_modules/update-notifier
ava 0.1.0 - 4.0.0-rc.1
Depends on vulnerable versions of update-notifier
node_modules/ava
node-fetch <2.6.7
Severity: high
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - https://github.com/advisories/GHSA-r683-j2x4-v87g
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/puppeteer/node_modules/node-fetch
puppeteer 10.0.0 - 13.1.1
Depends on vulnerable versions of node-fetch
node_modules/puppeteer
7 vulnerabilities (5 moderate, 2 high)
To address all issues (including breaking changes), run:
npm audit fix --force
Would be great to have these looked into.
@AVGP Trying to see if you got a chance to look at the PR? I will be happy to help maintain the project.
@gravi2 I'm using it in production now, currently at 2200 pages cached for some rather heavy duty sites. Have not found any issues so far. Should reach 20K cached in 2 weeks. Caches pages are in file system.
Is there something you can do regarding the vulnerabilities?