Fix npm security vulnerabilities

[lawdank]

We are using Leaf v3.11.1 & the related npm version 6.14.17
npm related Security vulnerabilities have been flagged for us.

Using command - npm audit fix
fixed 6 of 59 vulnerabilities in 1772 scanned packages
1 vulnerability required manual review and could not be updated
1 package update for 52 vulnerabilities involved breaking changes

On checking further [using command - npm audit]:
=== npm audit security report ===

Run npm install [email protected] to resolve 52 vulnerabilities
SEMVER WARNING: Recommended action is a potentially breaking change

Since, this could be a potentially breaking change. Do you have a recommended version of npm that we can safely upgrade to or upgrading single package react-script is safe or something else?

[artgoldberg]

Hi @ndobb and @mh2727 . lawdank is my colleague Sheersha reverse(Kandwal).

Restating her question, how far can we advance the npm version without breaking the Leaf GUI?

Thanks
Arthur

[ndobb]

@lawdank and @artgoldberg I will try to test things out tomorrow and let you know. Upgrading JavaScript dependencies with npm tends to be a never-ending game a whack-a-mole.

[artgoldberg]

Hello @ndobb & @lawdank
@ndobb, we greatly appreciate your attention to our concerns about npm vulnerabilities. Nice work on resolving them and thank you for providing a detailed explanation of the relationships between npn and react-scripts, and their roles in dev and production.
I expect that our security folks will be reassured that "the security issues listed shouldn't affect a production environment (to the best of Nic's knowledge)."
Arthur

[lawdank]

Thank you @ndobb & @artgoldberg

[lawdank]

Hi @ndobb - I executed npm command on our production server with the --production flag & could still see the same result :

[ndobb]

Right, nothing surprising there @lawdank - unless you're willing to also update the Leaf source code, such warnings will not go away and the app will cease to compile if you force an upgrade. As I mentioned, I have an active branch with those issues resolved, but until we have tested it a bit more it won't be an official release.

[lawdank]

Ah... Got it. Thanks @ndobb . We will wait for the official release.