adobe / adobe/aem-project-archetype
The aem-project-archetype relies on vulnerable third-party libs
- Dominant language
- JavaScript
- Stars
- 596
- Forks
- 431
- Avg merge
- 10d 6h
- Merged PRs (30d)
- 1
Description
The aem-project-archetype relies on vulnerable third-party libs. This affects the archetype maven project and the projects generated by the archetype.
### Reference
List of package definition in the aem-project-archetype repository
```
% find aem-project-archetype -name package.json
aem-project-archetype/src/main/archetype/ui.tests/test-module/package.json
aem-project-archetype/src/main/archetype/ui.frontend.angular/package.json
aem-project-archetype/src/main/archetype/ui.frontend.general/package.json
aem-project-archetype/src/main/archetype/ui.frontend.react/package.json
```
Example in aem-project-archetype
```
% npm audit
# npm audit report
[...]
19 vulnerabilities (18 moderate, 1 high)
[...]
```
Example in project generated from the archetype
```
% npm i --package-lock-only
[...]
29 vulnerabilities (19 moderate, 10 high)
[...]
```
### Recommendation
For every package.json, apply one of the following suggestions:
Remove usage and vulnerable dependencies
Upgrade to avulnerability free version of the embedded libraries.
Contributor guide
Research direction
Inspect the package.json files under aem-project-archetype/src/main/archetype/ui.tests/test-module, ui.frontend.angular, ui.frontend.general, and ui.frontend.react. Run npm audit in the archetype and in a generated project, then remove or upgrade vulnerable dependencies and verify that both audit results no longer report the affected vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- build-system, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100