Closed askb closed 3 years ago
Just a note this is the PR that is failing on the minimist dependencies: https://gerrit.linuxfoundation.org/infra/c/releng/global-jjb/+/65869 https://logs.opendaylight.org/releng/vex-yul-odl-jenkins-1/lf-infra-global-jjb-tox-verify-any/2970/console.log.gz
@RichardLitt pls review the PR. TIA
Why was grunt added?
@RichardLitt Grunt was one of the peer depenencies that was required to be installed to fix vulnerabilities.
$ npm install npm WARN deprecated jasmine-node@2.0.1: jasmine-node 1.x & 2.x are deprecated, with known vulnerability in jasmine-growl-reporter pre-2.0.0 npm WARN deprecated mkdirp@0.3.5: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.) npm WARN deprecated coffee-script@1.7.1: CoffeeScript on NPM has moved to "coffeescript" (no hyphen)
core-js-pure@3.8.1 postinstall /home/abelur/git/write-good/node_modules/core-js-pure node -e "try{require('./postinstall')}catch(e){}"
Thank you for using core-js ( https://github.com/zloirock/core-js ) for polyfilling JavaScript standard library!
The project needs your help! Please consider supporting of core-js on Open Collective or Patreon:
https://opencollective.com/core-js https://www.patreon.com/zloirock
Also, the author of core-js ( https://github.com/zloirock ) is looking for a good job -)
npm notice created a lockfile as package-lock.json. You should commit this file. npm WARN grunt-exec@0.4.7 requires a peer of grunt@>=0.4 but none is installed. You must install peer dependencies yourself.
added 244 packages from 198 contributors and audited 244 packages in 15.171s
29 packages are looking for funding
run npm fund
for details
found 3 vulnerabilities (2 low, 1 critical)
run npm audit fix
to fix them, or npm audit
for details
[abelur@abelur-t460s write-good]$ npm audit fix
npm WARN grunt-exec@0.4.7 requires a peer of grunt@>=0.4 but none is installed. You must install peer dependencies yourself.
up to date in 1.234s
29 packages are looking for funding
run npm fund
for details
fixed 0 of 3 vulnerabilities in 244 scanned packages
2 package updates for 3 vulnerabilities involved breaking changes
(use npm audit fix --force
to install breaking changes; or refer to npm audit
for steps to fix these manually)
Thanks.
Minimist package has moved from artifactory server that is shutdown to upstream. Minimist exists now in the official npm registry https://www.npmjs.com/package/minimist
Downstream change to pull the latest version of write-good fails with the following error:
npm ERR! network request to http://artifactory.otenv.com/artifactory/api/npm/npm-virtual/minimist/-/minimist-0.0.8.tgz failed, reason: getaddrinfo ENOTFOUND artifactory.otenv.com
Signed-off-by: Anil Belur abelur@linuxfoundation.org