Vulnerabilities

[adriatic]

For some time GitHub checks the file package-lock.json to detect vulnerabilities - this course as it exists today results with the following diagnose (as a consequence of running npm install:

found 39 vulnerabilities (27 low, 3 moderate, 9 high) in 24102 scanned packages
  run `npm audit fix` to fix 25 of them.
  14 vulnerabilities require semver-major dependency updates.

I am proposing to update the file `package.json' to be:

{
  "name": "rxjs-course",
  "version": "0.0.0",
  "license": "MIT",
  "scripts": {
    "ng": "ng",
    "start": "./node_modules/.bin/ng serve  --proxy-config ./proxy.json",
    "server": "./node_modules/.bin/ts-node ./server/server.ts",
    "build": "ng build",
    "test": "ng test",
    "lint": "ng lint",
    "e2e": "ng e2e"
  },
  "private": true,
  "dependencies": {
    "@angular/animations": "7.0.0",
    "@angular/cdk": "^7.0.0",
    "@angular/common": "7.0.0",
    "@angular/compiler": "7.0.0",
    "@angular/core": "7.0.0",
    "@angular/forms": "7.0.0",
    "@angular/http": "7.0.0",
    "@angular/material": "^7.0.0",
    "@angular/material-moment-adapter": "7.0.0",
    "@angular/platform-browser": "7.0.0",
    "@angular/platform-browser-dynamic": "7.0.0",
    "@angular/router": "7.0.0",
    "body-parser": "^1.18.3",
    "core-js": "^2.4.1",
    "express": "^4.16.2",
    "hammerjs": "^2.0.8",
    "moment": "^2.22.2",
    "rxjs": "6.3.3",
    "zone.js": "^0.8.14"
  },
  "devDependencies": {
    "@angular-devkit/build-angular": "^0.11.0",
    "@angular/cli": "^7.1.0",
    "@angular/compiler-cli": "7.0.0",
    "@angular/language-service": "7.0.0",
    "@types/express": "^4.0.39",
    "@types/jasmine": "~2.5.53",
    "@types/jasminewd2": "~2.0.2",
    "@types/node": "~6.0.60",
    "codelyzer": "~4.2.1",
    "jasmine-core": "~2.6.2",
    "jasmine-spec-reporter": "~4.1.0",
    "karma": "^3.1.1",
    "karma-chrome-launcher": "~2.1.1",
    "karma-cli": "~1.0.1",
    "karma-coverage-istanbul-reporter": "^1.2.1",
    "karma-jasmine": "~1.1.0",
    "karma-jasmine-html-reporter": "^0.2.2",
    "protractor": "^5.4.1",
    "ts-node": "~3.2.0",
    "tslint": "~5.7.0",
    "typescript": "3.1.3"
  }
}

After running the npm install with this package.json, run the following:

npm update fsevents --depth 6
 npm update request --depth 3
 npm update fill-range --depth 7

This results with clean build - 0 vulnerabilities

[rierjarv]

Thanks for the info. I just run
npm install
and it found 40 vulnerabilities. I ran
npm audit fix
The console output after this was
# Run npm install --save-dev [email protected] to resolve 12 vulnerabilities SEMVER WARNING: Recommended action is a potentially breaking change
I tested my luck by performing the recommended action. Works, no errors. I use Windows 10.