CARLI/select

Investigate Github security warnings for NPM packages

Opened this issue · 2 comments

mekane commented

Gordon reported some security warnings when he pushed to master. Need to look through these and see which ones might impact the project.

https://basecamp.com/1835867/projects/15140514/messages/77113404

mekane commented

The plan, as discussed with @BrianWalters :

  1. Fix package-lock.json
  2. "Shrink-wrap" / snapshot the production node_module (so we are confident we can revert / re-create the production setup)
  3. Make an "experimental" branch to systematically upgrade packages and make sure that each update works. (update one at a time, test rigorously, commit after each so that there is always a maximum of one undo to get back to a working state)
  4. See if there are any leftover security warnings after updating packages
  5. Look into updating the Node version, try this on the devel server
mekane commented
  1. Brian has fixed the package-lock issues
  2. I put this on a branch called node-modules-freeze
  3. Brian is working on this. We have removed nearly all of the security warnings
  4. The one or two that are left are marked as low impact and are for development tools, so we do not believe they require addressing.
  5. Still TODO