enjalot / enjalot/blockbuilder

fix vulnerabilities in dependencies

Open
#228 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
332
Forks
59
PR merge metrics
No merged PRs in 30d

Description

found 825 vulnerabilities (764 low, 45 moderate, 14 high, 2 critical)
run `npm audit fix` to fix them, or `npm audit` for details

![screen shot 2018-10-31 at 6 30 37 am](https://user-images.githubusercontent.com/2119400/47791322-a7bb9280-dcd6-11e8-9685-12a77ea94a8f.png)

## steps to reproduce

```bash
node -v
# v8.12.0
npm -v
# v6.4.1

npm install
```

text

```bash
➜ blockbuilder git:(master) npm install
> node-sass@4.9.3 install /home/ubuntu/blockbuilder/node_modules/node-sass
> node scripts/install.js
Downloading binary from https://github.com/sass/node-sass/releases/download/v4.9.3/linux-x64-57_binding.node
Download complete..] - :
Binary saved to /home/ubuntu/blockbuilder/node_modules/node-sass/vendor/linux-x64-57/binding.node
Caching binary to /home/ubuntu/.npm/node-sass/4.9.3/linux-x64-57_binding.node
> node-sass@4.9.3 postinstall /home/ubuntu/blockbuilder/node_modules/node-sass
> node scripts/build.js
Binary found at /home/ubuntu/blockbuilder/node_modules/node-sass/vendor/linux-x64-57/binding.node
Testing binary
Binary is fine
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.0.14 (node_modules/webpack/node_modules/watchpack/node_modules/chokidar/node_modules/
fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.0.14: wanted {"os":"darwin","arch":"any"} (current: {"os":"lin
ux","arch":"x64"})
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.4 (node_modules/fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.2.4: wanted {"os":"darwin","arch":"any"} (current: {"os":"linu
x","arch":"x64"})
added 2280 packages from 626 contributors and audited 15075 packages in 60.844s
found 825 vulnerabilities (764 low, 45 moderate, 14 high, 2 critical)
run `npm audit fix` to fix them, or `npm audit` for details
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by running npm audit and npm install with the reported Node v8.12.0 and npm v6.4.1 environment, then inspect the dependency findings. The issue names no manifest, lockfile, test, or entry point; done means the reported dependency vulnerabilities are addressed without breaking installation.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.