Update EZID UI build tool packages to fix critical vulnerabilities #520
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
The current state of the EZID UI is already baked into the application, so it's not necessary to install the build tool (via |
jsjiang
approved these changes
Dec 5, 2023
|
tested these changes on EZID Dev, everything looks good. |
rushirajnenuji
approved these changes
Dec 6, 2023
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
7 node packages have minor and patch updates applied via
npm updatecommand. One package has a major version update. These updates clear all vulnerabilities marked as "critical" when runningnpm audit. There are still 60 vulnerabilities listed in the audit, but all are ranked below critical status.Included in these updates was this critical issue, which can now be closed: #491
Attempts were made to update the major versions of the 7 packages and lesser versions of others but doing so would break the build tool. Many packages are currently obsolete or no longer maintained.
Scripts for npm were added and build tool instructions clarified to help improve the tool usability. These new scripts should not have broken prior EZID app dependencies or build processes, but this should be verified before merging this PR into production.
The readme here documenting the UI organization and build processes may be out of date and contain information that is no longer relevant: https://github.com/CDLUC3/ezid/blob/main/dev/README