bitshares / bitshares/bitshares-ui
node vulnerabilities
- Dominant language
- JavaScript
- Stars
- 520
- Forks
- 575
- Avg merge
- 12h 7m
- Merged PRs (30d)
- 5
Description
**Describe the bug**
Number of vulnerabilities are reported by Node packages & a large majority can be fixed by `npm audit fix`. It will be great if a review of the packages is done and attempt to test after automated and manual updation of manual packages.
**To Reproduce**
Steps to reproduce the behavior:
1. clone the code
2. do `nvm install 10` ; `nvm use 10` ;
3. install packages from source folder using `npm i`
4. npm lists vulnerable packages
**Expected behavior**
The vulnerabilities should be minor ones.
**Desktop (please complete the following information):**
- OS: macOS
- Version 11.01
- Node v10.23.0
**Additional context**
Synk reported https://snyk.io/vuln/SNYK-JS-CHARTJS-1018716 though not sure whether its already covered in the npm reports.
Contributor guide
Research direction
Start in the source folder by installing the packages with Node 10.23.0 and reviewing the output of npm audit and npm list. Check the reported Chart.js vulnerability against the Snyk reference, then review which updates are safe and test the application after changes. Done means the dependency vulnerabilities have been assessed or reduced without breaking the project.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100