Npm audit

[medied]

Summary:

• fixes 466 of 506 vulnerabilities
• of the 40 remaining vulnerabilities:
  • 38 vulnerabilities boil down to these 3 packages, each one with an already open Github issue
    • trim: Vulnerability on @storybook/addon-docs related with trim storybookjs/storybook#14603.
    • glob-parent: glob-parent Security Vulnerability storybookjs/storybook#15174.
    • browserslist: browserslist Security Vulnerability storybookjs/storybook#15173.
  • 2 package updates for 2 vulnerabilities involves breaking changes [1]:
    • upgrading webpack-dev-server is indeed breaking my local set up (with this error [2]).
    • Shall we fix these with a separate PR?

---

[1]

                       === npm audit security report ===


# Run  npm install --save-dev webpack@5.51.1  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack [dev]                                                │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack > watchpack > watchpack-chokidar2 > chokidar >       │
│               │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1751                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

# Run  npm install --save-dev webpack-dev-server@4.1.0  to resolve 1 vulnerability
SEMVER WARNING: Recommended action is a potentially breaking change
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Moderate      │ Regular expression denial of service                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ glob-parent                                                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ webpack-dev-server [dev]                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ webpack-dev-server > chokidar > glob-parent                  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1751                            │
└───────────────┴──────────────────────────────────────────────────────────────┘

[2]

emedina@wmf2669 wikipedia-preview % npm run dev
> wikipedia-preview@1.3.0 dev /Users/emedina/internet/wikimedia/wikipedia-preview
> webpack-dev-server --mode development --host=0.0.0.0 --disable-host-check

The command moved into a separate package: @webpack-cli/serve
Would you like to install serve? (That will run npm install -D @webpack-cli/serve) (yes/NO) : y
npm WARN @storybook/addon-measure@2.0.0 requires a peer of @storybook/addons@^6.3.0 but none is installed. You must install peer dependencies yourself
… 
… 
… 
found 38 vulnerabilities (28 moderate, 10 high)
  run `npm audit fix` to fix them, or `npm audit` for details
TypeError: Class constructor ServeCommand cannot be invoked without 'new'
    at runWhenInstalled (/Users/emedina/internet/wikimedia/wikipedia-preview/node_modules/webpack-cli/bin/utils/prompt-command.js:46:9)
    at /Users/emedina/internet/wikimedia/wikipedia-preview/node_modules/webpack-cli/bin/utils/prompt-command.js:124:15
    at processTicksAndRejections (internal/process/task_queues.js:97:5)
npm ERR! code ELIFECYCLE
npm ERR! errno 1
npm ERR! wikipedia-preview@1.3.0 dev: `webpack-dev-server --mode development --host=0.0.0.0 --disable-host-check`
npm ERR! Exit status 1
npm ERR!
npm ERR! Failed at the wikipedia-preview@1.3.0 dev script.
npm ERR! This is probably not a problem with npm. There is likely additional logging output above.

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/emedina/.npm/_logs/2021-09-01T15_50_29_419Z-debug.log

[stephanebisson]

Running npm audit with this PR give me: "26 vulnerabilities (18 moderate, 8 high)"

Is it possible that there is so many new issues since the PR was created? Maybe. I'll try fixing some more and bringing this branch up to date with the latest.

[stephanebisson]

It turns out npm audit fix can't fix anything more at this point. I'll merge this PR and let the new issues be addressed next month.