adobe / adobe/aem-project-archetype

The aem-project-archetype relies on vulnerable third-party libs

Open
#849 3 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
596
Forks
431
Avg merge
10d 6h
Merged PRs (30d)
1

Description

The aem-project-archetype relies on vulnerable third-party libs. This affects the archetype maven project and the projects generated by the archetype.

### Reference
List of package definition in the aem-project-archetype repository

```
% find aem-project-archetype -name package.json
aem-project-archetype/src/main/archetype/ui.tests/test-module/package.json
aem-project-archetype/src/main/archetype/ui.frontend.angular/package.json
aem-project-archetype/src/main/archetype/ui.frontend.general/package.json
aem-project-archetype/src/main/archetype/ui.frontend.react/package.json
```
Example in aem-project-archetype

```
% npm audit
# npm audit report
[...]
19 vulnerabilities (18 moderate, 1 high)
[...]
```
Example in project generated from the archetype

```
% npm i --package-lock-only
[...]
29 vulnerabilities (19 moderate, 10 high)
[...]
```
### Recommendation
For every package.json, apply one of the following suggestions:

Remove usage and vulnerable dependencies
Upgrade to avulnerability free version of the embedded libraries.

Contributor guide

Open the contributing guide

Research direction

Inspect the package.json files under aem-project-archetype/src/main/archetype/ui.tests/test-module, ui.frontend.angular, ui.frontend.general, and ui.frontend.react. Run npm audit in the archetype and in a generated project, then remove or upgrade vulnerable dependencies and verify that both audit results no longer report the affected vulnerabilities.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
build-system, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.