hasura / hasura/graphql-engine
[console] Lots of deprecated and vulnerable packages
- Dominant language
- TypeScript
- Stars
- 32.1k
- Forks
- 3k
- PR merge metrics
- PR metrics pending
Description
```
git clone this repo
cd graphql-engine/console
npm i
```
output:
```
318 packages are looking for funding
run `npm fund` for details
found 313 vulnerabilities (8 low, 127 moderate, 130 high, 48 critical)
run `npm audit fix` to fix them, or `npm audit` for details
```
I can't paste the full report here because it's too long for an issue on Github.
Someone from the team should look at this and remedy it, as console is often turned on in production.
**You also depend on 4999 packages**! Perhaps aim to lower this count (supply chain attacks anyone?)
Contributor guide
Research direction
Clone the repository, enter graphql-engine/console, install dependencies with npm i, and run npm audit to inspect the reported vulnerabilities. Review the deprecated and vulnerable packages in the console dependency set; done means the dependency issues are remedied and the audit results are materially improved.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- typescript
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100