Skip to content

Fix npm audit warnings

Kyriakos Barbounakis requested to merge kbarbounakis/universis-teachers:npm-audit-fix into master

This MR fixes several npm audit warnings

There are still 4 warnings:

                                                                                
                       === npm audit security report ===                        
                                                                                
# Run  npm install --save-dev @angular/compiler-cli@9.1.2  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Regular Expression Denial of Service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ braces                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @angular/compiler-cli [dev]                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @angular/compiler-cli > chokidar > anymatch > micromatch >   │
│               │ braces                                                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/786                             │
└───────────────┴──────────────────────────────────────────────────────────────┘


# Run  npm install ngx-infinite-scroll@8.0.2  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ ngx-infinite-scroll                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ ngx-infinite-scroll > opencollective > minimist              │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌──────────────────────────────────────────────────────────────────────────────┐
│                                Manual Review                                 │
│            Some vulnerabilities require your attention to resolve            │
│                                                                              │
│         Visit https://go.npm.me/audit-guide for additional guidance          │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Cross-Site Scripting                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ bootstrap                                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=3.4.1 <4.0.0 || >=4.3.1                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @universis/theme                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @universis/theme > bootstrap                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/891                             │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in    │ >=0.2.1 <1.0.0 || >=1.2.3                                    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ protractor [dev]                                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ protractor > optimist > minimist                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 4 vulnerabilities (3 low, 1 moderate) in 47657 scanned packages
  2 vulnerabilities require semver-major dependency updates.
  2 vulnerabilities require manual review. See the full report for details.

Related issues and links

npm audit fix updates @angular-devkit/build-angular to version 0.13.10 which has a known bug while trying to build an angular with --source-map flag.

Angular build Failing with “Data path '.sourceMap' should be object.”

https://stackoverflow.com/questions/54596270/angular-build-failing-with-data-path-sourcemap-should-be-object/54685804

So this MR changes heroku-postbuild by removing --prod --source-map flag.

"heroku-postbuild": "npm run ng -- build"

This removal affects active application configuration. Now application will try to load app.development.json instead of app.production.json. CI heroku pipeline may be failed due to this change.

Merge request reports