search

poanetwork / poa-dapps-voting

POA Network Governance Dapp
https://voting.poa.network
GNU General Public License v3.0
26 stars 54 forks source link

(Fix) Update packages to avoid vulnerabilities #149

Closed varasev closed 6 years ago

varasev commented 6 years ago
varasev commented 6 years ago

@vbaranov yes, it does. I used node v8.11.2 and npm v6.1.0.

vbaranov commented 6 years ago

@varasev the latest LTS release of node includes npm 5.6.0:

Latest LTS Version: 8.11.3 (includes npm 5.6.0)

I would suggest to use an LTS version of node and npm to generate package-lock.json. It will differ.

varasev commented 6 years ago

@vbaranov I used npm 6.1.0 because it shows known vulnerabilities and helps to fix ones. I tried to install npm packages using new package.json and package-lock.json with npm 5.6.0 (on my another machine) and test DApp with it - everything installs and works fine.

It seems that package-lock.json is different every time we launch npm install even with the same version of npm.

NPM suggests upgrading its version to 6.1.0 even when we use node v8.11. So, I think it's ok and we shouldn't worry about this.

vbaranov commented 6 years ago

@varasev

NPM suggests upgrading its version to 6.1.0 even when we use node v8.11

Could you post the link to this suggestion?

varasev commented 6 years ago

@vbaranov

Could you post the link to this suggestion?

NPM 5.6.0 shows the suggestion right in the console when we're working with it. I can't show you a screen because it is shown only sometimes (unless we upgrade it) but it looks like this: https://i.stack.imgur.com/CdKR2.png (the screen was taken from https://stackoverflow.com/questions/6237295/how-can-i-update-node-js-and-npm-to-the-next-versions).

varasev commented 6 years ago

Another link: https://medium.com/npm-inc/announcing-npm-6-5d0b1799a905 - they don't tell that we should use npm 6 only with node 10.