search

CDLUC3 / ezid

CDLUC3 ezid
MIT License
11 stars 4 forks source link

Update EZID UI build tool packages to fix critical vulnerabilities #520

Closed JoelCDL closed 7 months ago

JoelCDL commented 7 months ago

7 node packages have minor and patch updates applied via npm update command. One package has a major version update. These updates clear all vulnerabilities marked as "critical" when running npm audit. There are still 60 vulnerabilities listed in the audit, but all are ranked below critical status.

Included in these updates was this critical issue, which can now be closed: https://github.com/CDLUC3/ezid/pull/491

Attempts were made to update the major versions of the 7 packages and lesser versions of others but doing so would break the build tool. Many packages are currently obsolete or no longer maintained.

Scripts for npm were added and build tool instructions clarified to help improve the tool usability. These new scripts should not have broken prior EZID app dependencies or build processes, but this should be verified before merging this PR into production.

The readme here documenting the UI organization and build processes may be out of date and contain information that is no longer relevant: https://github.com/CDLUC3/ezid/blob/main/dev/README

JoelCDL commented 7 months ago

The current state of the EZID UI is already baked into the application, so it's not necessary to install the build tool (via npm install) or run any of it's commands once this PR is merged.

rushirajnenuji commented 7 months ago

tested these changes on EZID Dev, everything looks good.