Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implement auditjs and migrate from http-server to local-web-server #15

Merged
merged 2 commits into from
Mar 4, 2021

Conversation

rav-pradhan
Copy link
Contributor

@rav-pradhan rav-pradhan commented Mar 3, 2021

What

  • Implemented auditjs as our vulnerability auditing tool instead of npm audit. This is to provide us with the flexibility to manage an allowlist for any vulnerabilities we want to bypass.

  • Owing to running auditjs, it was noted that http-server has a vulnerability which has been unpatched. It is around the ecstatic dependency. On further reading, it looks like ecstatic has been deprecated since May 2019. It doesn't look like http-server has been updated to account for this. On that note, this PR also includes a change from http-server to local-web-server for the development server. As I understand, there shouldn't be any differences than with using http-server, other than the API. I was able to still link to the main.css served at localhost:9001.

How to review

Check that the audit command runs as intended

Check that local-web-server works as a suitable replacement for http-server

Who can review

Anyone

jondewijones
jondewijones previously approved these changes Mar 3, 2021
@rav-pradhan rav-pradhan merged commit 134a940 into main Mar 4, 2021
@rav-pradhan rav-pradhan deleted the feature/auditjs branch March 4, 2021 09:23
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

3 participants