search

pouchdb-community / pouchdb-authentication

User authentication plugin for PouchDB and CouchDB.
Apache License 2.0
774 stars 118 forks source link

pouchdb-ajax dependency depreciated and related vulnerabilities #265

Open subz390 opened 4 years ago

subz390 commented 4 years ago

pouchdb-ajax dependency depreciated, are there plans to remedy the issue? I was installing pouchdb-authentication today and got a load of warnings about it's dependencies being depreciated too. How easy is it to fix this?

warning pouchdb-authentication > pouchdb-ajax > request@2.83.0: request has been deprecated, see https://github.com/request/request/issues/3142
warning pouchdb-authentication > pouchdb-ajax > request > hawk@6.0.2: This module moved to @hapi/hawk. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
warning pouchdb-authentication > pouchdb-ajax > request > har-validator@5.0.3: this library is no longer supported
warning pouchdb-authentication > pouchdb-ajax > request > hawk > cryptiles@3.1.4: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning pouchdb-authentication > pouchdb-ajax > request > hawk > sntp@2.1.0: This module moved to @hapi/sntp. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues.
warning pouchdb-authentication > pouchdb-ajax > request > hawk > boom@4.3.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning pouchdb-authentication > pouchdb-ajax > request > hawk > cryptiles > boom@5.2.0: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning pouchdb-authentication > pouchdb-ajax > request > hawk > hoek@4.2.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning pouchdb-authentication > pouchdb-ajax > request > hawk > sntp > hoek@4.2.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning pouchdb-authentication > pouchdb-ajax > request > hawk > boom > hoek@4.2.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
warning pouchdb-authentication > pouchdb-ajax > request > hawk > cryptiles > boom > hoek@4.2.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial).
SinanGabel commented 4 years ago

Also see #249

uaru commented 3 years ago

As of today the results ofnpm audit

found 458 vulnerabilities (164 low, 155 moderate, 137 high, 2 critical) in 1722 scanned packages

This seems awfully high for a package for authentication

elverskog commented 2 years ago

Just bumping this. Had no npm issues/warnings but then upon installing pouchdb-authentication...

npm WARN deprecated cryptiles@3.1.4: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial). npm WARN deprecated sntp@2.1.0: This module moved to @hapi/sntp. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues. npm WARN deprecated har-validator@5.0.3: this library is no longer supported npm WARN deprecated boom@4.3.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial). npm WARN deprecated boom@5.2.0: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial). npm WARN deprecated hoek@4.2.1: This version has been deprecated in accordance with the hapi support policy (hapi.im/support). Please upgrade to the latest version to get the best features, bug fixes, and security patches. If you are unable to upgrade at this time, paid support is available for older versions (hapi.im/commercial). npm WARN deprecated hawk@6.0.2: This module moved to @hapi/hawk. Please make sure to switch over as this distribution is no longer supported and may contain bugs and critical security issues. npm WARN deprecated uuid@3.2.1: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated uuid@3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details. npm WARN deprecated request@2.83.0: request has been deprecated, see https://github.com/request/request/issues/3142

added 110 packages, and audited 847 packages in 7s

9 vulnerabilities (2 moderate, 4 high, 3 critical)

krishna-404 commented 1 year ago

Any update on this? are we supposed to not be using pouchdb-auth & be using something else. Doesnt sound right that the issue is pending since 2018. What am I missing?