[react-doctor] package.json (4 findings)

Open Beginner friendly
#362 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
68/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Active
Tech stack
react, typescript
Domain
security, tooling

Research direction

Start in package.json, reviewing the listed devDependencies and the maplibre-gl version constraint. Check whether @cloudflare/workers-types, @formatjs/cli, and @sentry/cli are used, then run npm audit and React Doctor to identify a safe maplibre-gl upgrade. Done means the unnecessary dependencies are removed or justified and package.json no longer reports these findings.

Written by the indexing model from the issue text.

Description

react-doctor severity:error tech-debt

React Doctor currently reports 4 findings in package.json.

  • unused-dev-dependency (warning, file-level) — Unused devDependency: @cloudflare/workers-types
    • Fix: An unused devDependency adds install time and supply-chain surface without being used; remove it from package.json if it is genuinely unused.
  • unused-dev-dependency (warning, file-level) — Unused devDependency: @formatjs/cli
    • Fix: An unused devDependency adds install time and supply-chain surface without being used; remove it from package.json if it is genuinely unused.
  • unused-dev-dependency (warning, file-level) — Unused devDependency: @sentry/cli
    • Fix: An unused devDependency adds install time and supply-chain surface without being used; remove it from package.json if it is genuinely unused.
  • low-supply-chain-score (error, L100:5) — maplibre-gl@5.24.0 (lowest version "^5.24.0" allows) scored 25/100 on Socket's vulnerability axis (minimum 50). This points to known security vulnerabilities (CVEs) affecting this version. Other axes — supply chain 98, maintenance 98, quality 100, license 70.
    • Fix: Upgrade to a version with no known advisories (run npm audit to find one), or replace it; update "maplibre-gl": "^5.24.0" in package.json. Full report: https://socket.dev/npm/package/maplibre-gl/overview/5.24.0. If you've reviewed and accepted this package, raise supplyChain.minScore (currently 50) or set supplyChain.severity: "warning".

This issue is maintained automatically. It will be updated while findings remain and closed when the file is clean.

Human triage notes below this marker are preserved by the weekly audit.

Dominant language
TypeScript
Stars
0
Forks
0
Avg merge
1d 7h
Merged PRs (30d)
29

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from digidem/comapeo-cloud-app

All issues in digidem/comapeo-cloud-app

Similar issues

More TypeScript issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.