search

certat / do-portal

This project is in maintenance mode and will only receive bug fixes, but no new features. A new version of this software is being developed.
5 stars 5 forks source link

npm audit: 13 vulnerabilities with high criticality #122

Open ghost opened 4 years ago

ghost commented 4 years ago

Branch master (in production)

npm audit says:

found 64 vulnerabilities (50 low, 1 moderate, 13 high) in 5469 scanned packages

This is already after the npm audit fix run.

davewood commented 4 years ago

Did you run the end2end tests after npm audit fix to make sure nothing broke?

davewood commented 4 years ago

branch devel

before npm audit fix

found 129 vulnerabilities (106 low, 1 moderate, 22 high)

/do-portal/epplication$ bash test.sh
copy test.sql to container
delete existing tests
Deleting tests ...
tests deleted successfully.
restore existing tests
Restoring tests ...
tests restored successfully.
copy test script to container
run test script
test details -> http://epplication-app:8081/job/1/show (admin/admin123)
selenium browser -> `xtightvncviewer localhost::5900` (password: `secret`)
pending
in_progress
in_progress
in_progress
in_progress
in_progress
in_progress
job finished.
duration: 67.167346 seconds.
no errors.

after npm audit fix

found 22 vulnerabilities (8 low, 1 moderate, 13 high)

/do-portal/epplication$ bash test.sh
copy test.sql to container
delete existing tests
Deleting tests ...
tests deleted successfully.
restore existing tests
Restoring tests ...
tests restored successfully.
copy test script to container
run test script
test details -> http://epplication-app:8081/job/2/show (admin/admin123)
selenium browser -> `xtightvncviewer localhost::5900` (password: `secret`)
pending
in_progress
in_progress
in_progress
in_progress
in_progress
in_progress
job finished.
duration: 66.517195 seconds.
no errors.
ghost commented 4 years ago

Did you run the end2end tests after npm audit fix to make sure nothing broke?

No, I thought npm audit fix is always safe?

davewood commented 4 years ago

I dont have enough experience to comment on the safety of npm audit fix.