Check project dependencies for possible updates

[tdipisa]

Description

Check project dependencies for possible updates

[baloola]

The security venerability is caused by the bootstrap version used in MapStore2, the github notifications recommends upgrading to bootstrap 4.
A first look at the possibility of upgrading to bootstrap 4 shows a problem, which is that bootstrap 4 uses SASS instead if LESS.

[mbarto]

Upgrading is a lof of effort, we should also migrate from react-bootstrap to reactstrap (that supports bootstrap 4, while react-bootstrap only supports 3).
It's not worth doing it only for a vulnerability (that I suspect also cannot happen the way we use it in MS2).

[offtherailz]

I agree with @mbarto , the migration is very hard.
I suggest to check what this vulnerability exactly is and if it affects also MapStore.
If it doesn't affect MS2 we could find an easy way to mute this alert, otherwise plan the update, but in this case the effort changes a lot

[tdipisa]

@baloola, since this is a moderate alert we can decrease the priority of the issue and plan the update later. I'm going to close it for the moment.

[zachsa]

Why was this closed without a fix applied? Github is actually flagging quite a few security vulnerabilities now:

[zachsa]

Doing an npm install, I get the following list of deprecated dependencies:

npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated @turf/[email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated @turf/[email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]
npm WARN deprecated [email protected]

[mbarto]

This one has been closed because we opened another issue to keep track of needed updates: #3528
That said, thanks for notifying us of security vulnerabilities. If you could also provide pull requests to solve some of them it would be greatly appreciated!

[zachsa]

I would love to contribute! When I finally figure out how to use the software I will do so! Zach

…

On Mon, Jul 8, 2019 at 3:08 PM mbarto ***@***.***> wrote: This one has been closed because we opened another issue to keep track of needed updates: #3528 <#3528> That said, thanks for notifying us of security vulnerabilities. If you could also provide pull requests to solve some of them it would be greatly appreciated! — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#3217?email_source=notifications&email_token=ABQK75ELAV4HESUUM3J2KQDP6M33NA5CNFSM4FZJPB4KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGODZNAYMA#issuecomment-509217840>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABQK75DTYA43WWOZ6D7IC5LP6M33NANCNFSM4FZJPB4A> .