markdown-spellcheck outdated and .spelling dictionary unmaintained

[MikeMcC399]

Problem description

The npm package markdown-spellcheck is involved in Dependabot alerts:

Alert	Severity	Requires	markdown-spellcheck *
Prototype Pollution in async	High	"async": ">=2.6.4"	@2.6.3
Inefficient Regular Expression Complexity in marked	High	"marked": ">=4.0.10"	@0.3.19

* Note that interdependencies affect the final outcome of the latest possible version possible. Use for example npm ls async to check.

Background

The cwa-documentation repository uses the npm package markdown-spellcheck version 1.3.1. This is the latest available version and it was published 5 years ago.

Although the Development on documentation instructions refer to spell-checking in the course of document submission, in practice the .spelling dictionary has not been updated for the last two years and is de-facto unmaintained. If npm run spellcheck is now run it produces an error message 242 spelling errors found in 15 files.

markdown-spellcheck is not capable of spell-checking in German.

• Issue https://github.com/corona-warn-app/cwa-documentation/issues/580 from @Ein-Tim was assigned to @dsarkar however it was closed without resolution and without feedback from the Open Source Team. This indicates that maintaining a spellchecker and dictionary in the repository is low priority.

Steps to reproduce the issue

• View Dependabot alerts on Security tab in GitHub
• Execute npm run spellcheck

Expected behavior

• Dependabot security alerts should be reduced to a minimum.
• If there is a spelling dictionary in the repository, then it should be maintained.

Possible Fix

markdown-spellcheck has not been used for the last two years and nobody is maintaining the spelling dictionary. The package itself is 5 years old with very low likelihood of a new release. In the workflow .github/workflows/checks.yml spell-checking is already disabled.

To resolve, I suggest:

• Remove markdown-spellcheck from repository.
• Remove .spelling dictionary
• Adjust documentation accordingly

Documentation submitters can use alternative spell checkers in future such as Spell Right for Visual Studio Code which can spell check in English and German.

[MikeMcC399]

If the Open Source Team agrees to remove markdown-spellcheck from this repository, I am happy to submit a PR to implement the change.

I accidently submitted this issue as a bug. Please adjust the labels accordingly. My apologies!

[larswmh]

@MikeMcC399 thank you for bringing this up and offering to submit a PR to implement the change. We would greatly appreciate a PR for this!

---

Corona-Warn-App Open Source Team

[MikeMcC399]

@larswmh

Thank you for the confirmation! I have submitted:

• https://github.com/corona-warn-app/cwa-documentation/pull/894

to resolve this issue