wp-now: Resolve npm audit warnings

[eliot-akira]

On installing @wp-now/wp-now, there's a warning:

4 moderate severity vulnerabilities

Running npm audit report shows:

express  <4.19.2
Severity: moderate
Express.js Open Redirect in malformed URLs - https://github.com/advisories/GHSA-rv95-896h-c2vc
No fix available
node_modules/express
  @php-wasm/node  >=0.1.18
  Depends on vulnerable versions of express
  node_modules/@php-wasm/node
  @wp-now/wp-now  *
  Depends on vulnerable versions of @php-wasm/node
  Depends on vulnerable versions of express
  Depends on vulnerable versions of follow-redirects
  node_modules/@wp-now/wp-now

follow-redirects  <=1.15.5
Severity: moderate
Follow Redirects improperly handles URLs in the url.parse() function - https://github.com/advisories/GHSA-jchw-25xp-jwwc
follow-redirects' Proxy-Authorization header kept across hosts - https://github.com/advisories/GHSA-cxjh-pqwp-8mfp
fix available via `npm audit fix`
node_modules/follow-redirects

Solution

While looking into this, I found that express is only used for tests in the entire Playground project.

./packages/php-wasm/node/src/test/php-networking.spec.ts:2:import express from 'express';

And there are unnecessary dependencies, express-fileupload and follow-redirects, which are only used for wp-now in the Playground Tools project.

./packages/wp-now/src/start-server.ts:4:import express from 'express';
./packages/wp-now/src/start-server.ts:7:import fileUpload from 'express-fileupload';

./packages/wp-now/src/download.ts:1:import followRedirects from 'follow-redirects';

So the solution is:

• @php-wasm/node
  • Update express to newest 4.19.2
  • Move it to devDependencies
  • Remove unused express-fileupload and follow-redirects
• @wp-now/wp-now
  • Add express to dependencies
  • Update follow-redirects to newest 1.15.6

I'll create two pull requests to address these.