zappr
zappr copied to clipboard
Update Dependencies - npm audit results
I used the new command npm audit
to check how many dependencies are outdated and have a vulnerability:
found 62 vulnerabilities (20 low, 26 moderate, 15 high, 1 critical)
I have a bigger report, I need to investigate more and I will add soon a more detailed table here. As a side note: This report is based on the package-lock.json file, which is the whole dependency tree not only our package.json. So updating some of the major frameworks might be necessary.
I'm adding to his now a first list of tasks which definitely need to be done:
- Update npm dependencies -> Fix failing tests
- Update to Babel v7 and configuration for it
- Update to webpack v4 and the configuration
Nice to check:
- Update nodejs to latest LTS -> see if we can reduce or even get rid of the compilation step for the server. It would (imho) reduce maintaince complexity regarding less dependencies to manage and easier debuggable instead of having one minified file. But I will ask for feedback in the web guild. Especially async/await and I think ES6+ "imports" are now supported with nodejs.