rammcodes / Dopefolio

Dopefolio 🔥 - Portfolio Template for Developers 🚀
https://dopefolio.netlify.app
GNU General Public License v3.0
3.4k stars 683 forks source link

Deprecated node libraries #16

Closed lem0n4id closed 3 years ago

lem0n4id commented 3 years ago

Multiple npm WARNs. Not sure if this is system specific...

Logs:

$ npm install
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated har-validator@5.1.5: this library is no longer supported

added 340 packages, and audited 341 packages in 17s

51 packages are looking for funding
  run `npm fund` for details

1 high severity vulnerability

To address all issues, run:
  npm audit fix

Run `npm audit` for details.
$ npm audit
# npm audit report

tar  <=4.4.17 || 5.0.0 - 5.0.9 || 6.0.0 - 6.1.8
Severity: high
Arbitrary File Creation/Overwrite due to insufficient absolute path sanitization - https://npmjs.com/advisories/1770
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning - https://npmjs.com/advisories/1771       
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links - https://npmjs.com/advisories/1779
Arbitrary File Creation/Overwrite via insufficient symlink protection due to directory cache poisoning using symbolic links - https://npmjs.com/advisories/1780
fix available via `npm audit fix`
node_modules/tar

1 high severity vulnerability

To address all issues, run:
  npm audit fix
jcubic commented 3 years ago

Note that deprecation warnings and security warnings from NPM are mostly useless because they are for dev dependencies.

I suggest you read an article npm audit: Broken by Design by Dan Abramov.