search

yamalight / outstated

Simple hooks-based state management for React
107 stars 7 forks source link

Fix: found 13 vulnerabilities (3 moderate, 5 high, 5 critical) #19

Closed roblevintennis closed 4 years ago

roblevintennis commented 4 years ago

Context

I'm evaluating whether to use redux or a lighter weight alternative for a greenfield company project, and after reading well over a dozen articles and researching for quite some time, I found outstated which I find appealing since it's understandable and has a nice API for a team versus rolling my own thing atop of Context/Hooks. So, I'm sort of evaluating this atm and may submit more PRs or not ;-) I think the more current and updated it is, the easier a time I will have in selling my team on not using Redux.

Issue (I'll log in issues and cross link)

I git cloned and ran npm install to find some security warnings which seemed easy to fix:

image

Fix & Verification

I just ran npm audit fix, but then ran all the npm scripts less clean to verify so you wouldn't have to:

npm run example

image

npm run prepublish

image

npm run test (all passing; looks like there's some handlebars related warnings?):

image

UPDATE: It's a known issue not related to Outstated or my PR

npm run build image

It looks like there's a less egregious warning for:

Browserslist: caniuse-lite is outdated. Please run next command `npm update`

I could submit a patch for that if you'd like but I don't think it should be mixed with this PR which just fixes audit errors. Also, maybe it's ignorable since running npm update will mean a huge increase to the lock file.

Also a warning I'm pretty sure I didn't cause with this:

image

I'd also be happy to submit a PR for that as well just lmk if interesting :)

yamalight commented 4 years ago

@roblevintennis thanks for the PR, merged :) sticking with Redux (or any other full-featured solution) would likely be better if your app is going to be larger than a few pages. outstated works best with small-ish apps.