Internal issue 3056 - eliminate audit exceptions on ui-kit repo
- Dominant language
- TypeScript
- Stars
- 53
- Forks
- 63
- Avg merge
- 2d 4h
- Merged PRs (30d)
- 15
Description
There are a number of items added to the allowlist (audit-ci.json) to ensure audit passes. Some of these could hopefully be eliminated once other work is complete:
moving to storybook v9 may help:
[https://github.com/mi6/ic-ui-kit/issues/3588|https://github.com/mi6/ic-ui-kit/issues/3588]
once e2e tests have been removed under
[https://github.com/mi6/ic-ui-kit/issues/3522|https://github.com/mi6/ic-ui-kit/issues/3522], it may be possible to remove puppeteer as a dev dependency - this is currently v13 with a number of vulnerabilities
UPDATE: puppeteer has been removed as dev dependency as part of https://github.com/mi6/ic-ui-kit/pull/3685, but the audit issue still remains as the problem lies in cypress-audit/lighthouse package - no current update available
An update to react router v7 should resolve some other vulnerabilities - this is only a dependency for our storybook examples that need it, so we could update the stories if it causes a breaking change
Contributor guide
Research direction
Start with audit-ci.json and the remaining audit output; review issues 3588 and 3522 for the dependency work they describe. Check the current dependency manifests and the changes from pull request 3685, then identify which allowlist entries can be removed and verify the audit passes without the affected vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cypress, react, typescript
- Domain
- security, testing, tooling
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100