Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Outdated packages with vulnerabilities #700

Open
peter-stewart-thg opened this issue Dec 17, 2024 · 4 comments
Open

Outdated packages with vulnerabilities #700

peter-stewart-thg opened this issue Dec 17, 2024 · 4 comments

Comments

@peter-stewart-thg
Copy link

We've been using this package for a number of years, but are currently seeing issues flagged up by dependabot.
Many of the NPM packages are outdated and have vulnerabilities.

Currently we're seeing 100 vulnerabilities:

  • Critical: 13
  • High: 54
  • Moderate: 24
  • Low: 9

I've started auditing the package to see if I can easily resolve these vulnerabilities, however, currently I'm seeing a number of deprecated packages used, so some if not all of these will need to be replaced.
There are also a number of packages that are no longer maintained.

We would like to continue using the package, however, these security vulnerabilities make that not an option for us at the moment.

I aim to complete my audit of the packages today, and will update this issue with my findings.
I will then see how feasible it is to resolve the vulnerabilities.

Do you plan to continue maintaining this package?
Is anyone else working on updating these packages?

If the package is going to be maintained,
I'm happy to help resolve these issues and get it back up and running.
Also, if there is someone who knows the package well, it would be very helpful to be able to discuss the packages that are currently used.
@peter-stewart-thg
Copy link
Author

I have been going through the packages this morning, and here is my initial analysis:

NPM Packages

Dev Dependencies

Dependencies

@peter-stewart-thg
Copy link
Author

I will now see if I can get these issue resolved and create a pull request if I'm successful.

@peter-stewart-thg peter-stewart-thg mentioned this issue Dec 18, 2024
Open
@peter-stewart-thg
Copy link
Author

I've now updated all the packages and resolved all related issue.
The PR is here: #701

There are a few deprecation warning related to 'sass-mq' as the package is using some method that are soon to be removed from 'sass'.

As far as I can tell, though, the whole package builds and all the npm scripts are working as expected.
I did need to rewrite quite a lot of the code, and I haven't fully tested the package on WordPress, so there might be some changes needed, but hopefully this is a good start.

Let me know if you have any questions.

@peter-stewart-thg
Copy link
Author

I have just made a few more changes to this after testing the package in our WordPress install.
Unfortunately the changes are not quite functioning as intended.

I have just update how "react-select/async" and ajax from "rxjs" are used to bring them inline with the latests packages, however, it's still not working perfectly.

I might not have any more time to work on this, so if anyone else is able to take this on, please let me know.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@peter-stewart-thg