Repository navigation
Add nsp support to all packages & plugins. #187
Description
I think it's a good idea to add this into the build/publishing process so we get alerts of vulnerabilities that pop up. What do you guys think? @feathersjs/core-team
https://nodesecurity.io/tools
We need to do this to each of these:
- feathers
- feathers-commons Add NSP check to test script. feathersjs-ecosystem/commons#16
- feathers-rest Adding nsp check feathersjs-ecosystem/feathers-rest#8
- feathers-socketio Adding nsp check feathersjs-ecosystem/socketio#6
- feathers-primus Adding nsp check feathersjs-ecosystem/primus#4
- feathers-socket-commons Adding nsp check feathersjs-ecosystem/transport-commons#1
- feathers-mongodb Adding nsp check feathers-mongodb#19
- feathers-mongoose Accidentally committed directly. Wrong key command. 🙃
- feathers-authentication Adding nsp check feathersjs-ecosystem/authentication#26
- feathers-client Adding nsp check feathersjs-ecosystem/client#24
- feathers-nedb Adding nsp check feathersjs-ecosystem/feathers-nedb#10 (error)
- feathers-memory Adding nsp check feathers-memory#12
- feathers-sequelize Adding nsp check feathersjs-ecosystem/feathers-sequelize#10
- feathers-knex Adding nsp check feathers-knex#27
- feathers-waterline Adding nsp check feathersjs-ecosystem/feathers-waterline#3
- feathers-query-filters Adding nsp check feathersjs-ecosystem/feathers-query-filters#7
- feathers-configuration Adding nsp check feathersjs-ecosystem/configuration#1
Activity
ekryski commentedon Dec 29, 2015
👍 I haven't use nsp before but sounds like a good idea to me.
daffl commentedon Dec 29, 2015
That sounds good. Can you run nsp against this repo and show how it looks?
daffl commentedon Jan 5, 2016
Did you get a chance to test it out? I would figure that all we need to do is add it as an NPM script.
marshallswain commentedon Jan 5, 2016
Nope. I didn't try it out, yet. I'll try it now.
marshallswain commentedon Jan 5, 2016
marshallswain commentedon Jan 18, 2016
It looks like they currently only make it easy to use a command line utility, but the gulp-nsp project shows how we could create an npm script to run the nsp package: https://github.com/nodesecurity/gulp-nsp/blob/master/index.js
daffl commentedon Jan 18, 2016
Why couldn't you just install the command line as a devDependency and run it from an NPM script?
marshallswain commentedon Jan 18, 2016
Oh yeah. Yep it works:
./node_modules/.bin/nsp checkdaffl commentedon Jan 18, 2016
As an npm script you won't even have to add
node_modules/.bin.marshallswain commentedon Jan 18, 2016
You're right. Where's the best place to integrate it? At the end of
test?marshallswain commentedon Jan 18, 2016
"test": "npm run compile && npm run jshint && npm run mocha && npm run nsp",marshallswain commentedon Jan 18, 2016
Actually, running it directly works
"test": "npm run compile && npm run jshint && npm run mocha && nsp check",It doesn't need the extra script.
marshallswain commentedon Jan 21, 2016
I copied the list to the first comment. We've only updated feathers core, so far.
marshallswain commentedon Jan 21, 2016
All plugins have a PR.
ekryski commentedon Jan 26, 2016
@marshallswain what's the issue with nedb? Would be nice to close this issue out.
marshallswain commentedon Jan 26, 2016
Looks like @daffl fixed it.
ekryski commentedon Jan 26, 2016
👍
Merge pull request #187 from bitsoflogic/master
lock commentedon Feb 7, 2019
This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue with a link to this issue for related bugs.