[Snyk] Fix for 11 vulnerable dependency paths

[snyk-bot]

Snyk has identified one or more vulnerable packages in the npm dependencies this project uses.

To fix those, Snyk created this pull request with the necessary changes to address the vulnerabilities.

This pull request includes:

• package.json scripts and a Snyk policy (.snyk) file, which patch the vulnerabilities that can't be upgraded away.

You can read more about Snyk's upgrade and patch logic in Snyk's documentation. Each vulnerability page (see below) includes information about the vulnerable versions, and direct links to the available patches.

This PR includes fixes for the following vulnerabilities:

• npm:minimatch:20160620
• npm:request:20160119
• npm:ws:20160624

See the Snyk test report for this project for details.

Some of the vulnerable paths we found do not have a patch nor an upgrade available, and so will remain after merging this PR. You should manually review those issues, and can choose to ignore them by running snyk wizard in the project's folder.

Be sure to check the changes in this PR to ensure they won't cause issues with your application.

Stay secure, The Snyk team

[jescalan]

Was testing this out to see if it would be helpful, but I dont think it will be for these projects. Cool idea for a service though!

[guypod]

Thanks for the kind words :)

I'm curious - what makes you think this won't be helpful for these projects?

[jescalan]

• Even after the service-generated PR to fix it, the service's hook still reported a few vulnerabilities, causing the tests to fail. Seems like tests would always fail based on this standard.
• Adds a runtime dependency
• This is a static site generator, so the vulnerabilities listed are irrelevant (example: the local dev server can be DDOS'ed... that's ok)

[guypod]

Thanks for the feedback. A few thoughts:

• Re the vulnerabilities remaining after the pull request: Indeed it seems like there are quite a few that we cannot offer a patch or upgrade for yet. In the meantime, if you'd like and feel it's not a security risk, you can run snyk wizard in your project and choose to ignore these issues, so they won't show up again. We're working on adding that to our web workflow too.
• Re runtime dependency: since we're patching the vulnerabilities post installation, we do have to be installed when you do a production deployment. There's no real way around it... We need to patch them in production, so Snyk has to run in production. However, to be crystal clear, note that we will not be loaded into memory in runtime, just at production install time (kinda like node-gyp)
• Re being an SSG: I understand, and it's probably not the top target. That said, it's very possible someone would use this project (or one like it) to offer an SSG service, or would run it long term within a company, so I would advise not to disregard security completely ;)

Anyways, thanks for the feedback, and hope you'll try Snyk out more in the future!