Skip to content
This repository was archived by the owner on Aug 8, 2023. It is now read-only.

Node Package Security Audit#23

Merged
bendvc merged 4 commits intodevelopfrom
security-audit
Jul 2, 2019
Merged

Node Package Security Audit#23
bendvc merged 4 commits intodevelopfrom
security-audit

Conversation

@bendvc
Copy link
Copy Markdown
Contributor

@bendvc bendvc commented Jun 28, 2019

Description

Update node packages to reduce the number of security vulnerabilities.

WEB-2359

  • Low Vulnerabilities reduced from 203 to 2
  • Moderate Vulnerabilities reduced from 21 to0
  • High Vulnerabilities reduced from 206 to 0
  • Critical Vulnerabilities reduced from 1 to 0

NOTE: There is 1 remaining low risk vulnerability. This is Regular Expression Denial of Service from the braces package. This is introduced by both babel-cli and mobify-code-style. Because these are low risk, and require more invasive intervention to fix, we'll address them in another PR

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Breaking change (fix or feature that would cause existing functionality to not work as expected)
  • Documentation update
  • Maintenance

Changes

  • Upgrade atob , superagent, babel-core, babel-preset-env, eslint, jsdoc, mobify-code-style, and mocha
  • Add babel-eslint.
  • Run linter
  • Fix tests after mocha upgrade

How to test this PR?

Ensure all tests are passing by running npm run test

Checklist:

  • My code follows the style guidelines of this project (npm run lint)
  • I have performed a self-review of my own code
  • I have made corresponding changes to the documentation (README.md and CHANGELOG.md)

@bendvc bendvc changed the title Security AUdit Node Package Security Audit Jun 28, 2019
@bendvc bendvc requested review from olibrook and stellafang June 28, 2019 20:37
@bendvc bendvc merged commit c2ed3e5 into develop Jul 2, 2019
@bendvc bendvc deleted the security-audit branch July 2, 2019 16:42
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.

Labels

None yet

Development

Successfully merging this pull request may close these issues.

2 participants