Open hunterlester opened 5 years ago
This task is more involved than appears:
package-lock.json
, spectron needs to be installed with npm i spectron --save-dev
, which will upgrade spectron
's major version. This breaks several tests, requiring a separate task to fix all the tasks when this task is concerned with finding and upgrading vulnerable dependencies.Proposal to close this task.
There are two possibly significant vulnerabilities identified, which should be resolved when we upgrade the electron
version:
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ Insufficient Entropy │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ cryptiles │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.1.3 <4.0.0 || >=4.1.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ electron │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ electron > electron-download > nugget > request > hawk > │
│ │ cryptiles │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/720 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ high │ Insufficient Entropy │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ cryptiles │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=3.1.3 <4.0.0 || >=4.1.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ asar │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ asar > mksnapshot > request > hawk > cryptiles │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://nodesecurity.io/advisories/720 │
└───────────────┴──────────────────────────────────────────────────────────────┘
Okay, let's mark this as blocked until the electron version is updated (and with that, we'd need to update spectron also, I suspect)
yarn
team is working on it's own command but it's not ready yet: https://github.com/yarnpkg/yarn/issues/5808package-lock.json
andnpm
@6.node_modules
directories and then runnpm i
to producepackage-lock.json
.npm audit
and thennpm audit fix
to upgrade vulnerable dependencies.package.json
will have been automatically updated.package-lock.json
yarn
to produce an updatedyarn.lock
to commit to repo.