start-server-and-test icon indicating copy to clipboard operation
start-server-and-test copied to clipboard

Patial fix for issue #394 vulnerabilities in dependencies reported by npm audit

Open BePo65 opened this issue 1 year ago • 0 comments

To remove the long list of vulnerabilities you get when updating packages in start-server-and-test I tried to update all used (dev-) Dependencies to the latest version. Some packages cannot be updated, because that would require to switch to esm-only format or requires a node version higher than V18 (which is the latest supported version and in maintenance mode by now).

Updating the packages reduces the list of vulnerabilities from

146 vulnerabilities (5 low, 34 moderate, 81 high, 26 critical)

to

59 vulnerabilities (3 low, 20 moderate, 27 high, 9 critical)

Not so bad, but far from perfect. It shows that some of the used packages have not been maintained for some years now.

Things I stumbled over during the updates:

  • chai v5 is esm only (and as a consequence we cannot update sinon-chai to v4 as this would require chai v5)
  • dependency-check is deprecated and recommends using knip (what I did)
  • prettier-standard seems to be abandoned (see sheerun/prettier-standard#137); I used prettier here. Unluckily this results in the effect that running pretty removes the space after the function keyword and running lint (to be exact: running standard) adds the space again.

Is it worth merging this pr? To be true, I am not completely convinced.

BePo65 avatar Dec 03 '24 05:12 BePo65