hasura / hasura/graphql-engine

[console] Lots of deprecated and vulnerable packages

Open
#8,390 0 comments 2 reactions 0 assignees View on GitHub
c/console k/enhancement
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

```
git clone this repo
cd graphql-engine/console
npm i
```

output:

```

318 packages are looking for funding
run `npm fund` for details

found 313 vulnerabilities (8 low, 127 moderate, 130 high, 48 critical)
run `npm audit fix` to fix them, or `npm audit` for details
```

I can't paste the full report here because it's too long for an issue on Github.

Someone from the team should look at this and remedy it, as console is often turned on in production.

**You also depend on 4999 packages**! Perhaps aim to lower this count (supply chain attacks anyone?)

Contributor guide

Open the contributing guide

Research direction

Clone the repository, enter graphql-engine/console, install dependencies with npm i, and run npm audit to inspect the reported vulnerabilities. Review the deprecated and vulnerable packages in the console dependency set; done means the dependency issues are remedied and the audit results are materially improved.

Written by the indexing model from the issue text.

Assessment

Tech stack
typescript
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.