btford / write-good

Naive linter for English prose
MIT License
4.95k stars 189 forks source link

Update the npm package dependencies #126

Closed askb closed 3 years ago

askb commented 3 years ago

Minimist package has moved from artifactory server that is shutdown to upstream. Minimist exists now in the official npm registry https://www.npmjs.com/package/minimist

Downstream change to pull the latest version of write-good fails with the following error:

npm ERR! network request to http://artifactory.otenv.com/artifactory/api/npm/npm-virtual/minimist/-/minimist-0.0.8.tgz failed, reason: getaddrinfo ENOTFOUND artifactory.otenv.com

Signed-off-by: Anil Belur abelur@linuxfoundation.org

askb commented 3 years ago

Just a note this is the PR that is failing on the minimist dependencies: https://gerrit.linuxfoundation.org/infra/c/releng/global-jjb/+/65869 https://logs.opendaylight.org/releng/vex-yul-odl-jenkins-1/lf-infra-global-jjb-tox-verify-any/2970/console.log.gz

askb commented 3 years ago

@RichardLitt pls review the PR. TIA

RichardLitt commented 3 years ago

Why was grunt added?

askb commented 3 years ago

@RichardLitt Grunt was one of the peer depenencies that was required to be installed to fix vulnerabilities.

$ npm install npm WARN deprecated jasmine-node@2.0.1: jasmine-node 1.x & 2.x are deprecated, with known vulnerability in jasmine-growl-reporter pre-2.0.0 npm WARN deprecated mkdirp@0.3.5: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.) npm WARN deprecated coffee-script@1.7.1: CoffeeScript on NPM has moved to "coffeescript" (no hyphen)

core-js-pure@3.8.1 postinstall /home/abelur/git/write-good/node_modules/core-js-pure node -e "try{require('./postinstall')}catch(e){}"

Thank you for using core-js ( https://github.com/zloirock/core-js ) for polyfilling JavaScript standard library!

The project needs your help! Please consider supporting of core-js on Open Collective or Patreon:

https://opencollective.com/core-js https://www.patreon.com/zloirock

Also, the author of core-js ( https://github.com/zloirock ) is looking for a good job -)

npm notice created a lockfile as package-lock.json. You should commit this file. npm WARN grunt-exec@0.4.7 requires a peer of grunt@>=0.4 but none is installed. You must install peer dependencies yourself.

added 244 packages from 198 contributors and audited 244 packages in 15.171s

29 packages are looking for funding run npm fund for details

found 3 vulnerabilities (2 low, 1 critical) run npm audit fix to fix them, or npm audit for details [abelur@abelur-t460s write-good]$ npm audit fix npm WARN grunt-exec@0.4.7 requires a peer of grunt@>=0.4 but none is installed. You must install peer dependencies yourself.

up to date in 1.234s

29 packages are looking for funding run npm fund for details

fixed 0 of 3 vulnerabilities in 244 scanned packages 2 package updates for 3 vulnerabilities involved breaking changes (use npm audit fix --force to install breaking changes; or refer to npm audit for steps to fix these manually)

RichardLitt commented 3 years ago

Thanks.