GoogleCloudPlatform / dialogflow-integrations

Dialogflow integrations with multiple platforms including KIK, Skype, Spark, Twlio, Twitter and Viber
https://cloud.google.com/dialogflow/
Apache License 2.0
246 stars 499 forks source link

Dialogflow CX integration with Discord : severe vulnerability and unable to build #244

Open parisneto opened 1 month ago

parisneto commented 1 month ago

While following the instructions to integrate DialogFlow to Discord here : https://github.com/GoogleCloudPlatform/dialogflow-integrations/tree/master/cx/discord

I eventually got to this point :

gcloud builds submit --tag gcr.io/your-project-id/dialogflow-discord

and it generate several warnings that I added to the end of this message.

I can confess DialogFlow has been the worst experience in Google Cloud including UX, Documentation and now this, I asked Gemini for Cloud Console to elaborate and it confirms it's not usable, meaning my project is dead on arrival.

Gemini Answer : Let's break down the errors and assess their severity:

  1. Unsupported Engine:

The error message indicates that the package discord-cx-integration@0.0.1 requires Node.js version 8.x, while your current environment is using Node.js v18.20.2. This incompatibility is causing the build to fail.

  1. Deprecated Packages:

Several packages in your project are marked as deprecated, meaning they are no longer actively supported and may have security vulnerabilities or compatibility issues. These include: @discordjs/form-data@3.0.1 @discordjs/collection@0.1.6 discord-buttons@4.0.0 discord.js@12.5.3

  1. Critical Severity Vulnerabilities:

The npm audit command has identified 3 critical severity vulnerabilities in your project. These vulnerabilities could potentially allow attackers to compromise your system or steal sensitive data. Severity Assessment:

The unsupported engine error is a critical issue that needs to be addressed immediately. It's preventing your Cloud Run service from building successfully. The deprecated packages are also a concern, as they may introduce security risks and compatibility problems. It's recommended to update them to their latest supported versions. The critical severity vulnerabilities are the most serious issue and should be addressed with high priority. Ignoring them could leave your system vulnerable to attacks. Recommendations:

Update discord-cx-integration : Try updating the discord-cx-integration package to a version compatible with Node.js v18. If no compatible version is available, you might need to find an alternative package or modify your code to work with the current Node.js version. Upgrade Deprecated Packages: Update the deprecated packages to their latest supported versions. This will help improve security and compatibility. Fix Critical Vulnerabilities: Address the critical vulnerabilities identified by npm audit . You can use the npm audit fix command to automatically fix some vulnerabilities, or you can manually update the vulnerable packages to patched versions.

Running in 33774196cd68 npm WARN config only Use --omit=dev to omit dev dependencies from the install. npm WARN EBADENGINE Unsupported engine { npm WARN EBADENGINE package: 'discord-cx-integration@0.0.1', npm WARN EBADENGINE required: { node: '8.x' }, npm WARN EBADENGINE current: { node: 'v18.20.2', npm: '10.5.0' } npm WARN EBADENGINE } npm WARN deprecated @discordjs/form-data@3.0.1: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info. npm WARN deprecated @discordjs/collection@0.1.6: no longer supported npm WARN deprecated discord-buttons@4.0.0: New lib is coming! Join our support server for more help: https://discord.gg/KUS5pjyA4J npm WARN deprecated discord.js@12.5.3: no longer supported

added 224 packages, and audited 225 packages in 21s

35 packages are looking for funding run npm fund for details

3 critical severity vulnerabilities

To address all issues, run: npm audit fix

Run npm audit for details. npm notice npm notice New minor version of npm available! 10.5.0 -> 10.8.0 npm notice Changelog: https://github.com/npm/cli/releases/tag/v10.8.0 npm notice Run npm install -g npm@10.8.0 to update! npm notice