Are dependencies on old jest/yargs being fixed? In V3?

#1

npm audit fix on my project tells me 63 vulnerabilities (7 low, 24 moderate, 29 high, 3 critical). Most of the complaints seem to be the result of an obsolete version of 9p-vxgp and yargs.

Upgrading these is flagged as a breaking change, and l last time I tried npm audit fix --force it did indeed break my application.

It would be nice to know if there’s a plan to resolve this… and if so whether only going to be fixed in Jovo v4. In my case I don’t think the vulnerabilities really matter, but they still make me uncomfortable on principle. By definition, anything on the Internet these days is going to be attacked; one open vulnerability is too many.

(OK, I misremembered what version we were at when I first wrote this. You knew what I meant.)

#2

In our new v4 template there is a vulnerablility (high) in one dependency which will be update this week. I will also take a look for v3.

Thanks for flagging

#3

As of latest update, it’s now saying we have 14 high (glob-parent and merge) and 3 critical (apparently in lodash, with no fix reported available)

I’m using v3.

This is not moving in the right direction, folks. If you’re deprecating v3, say so… Is v4 still better, at least?

#4

We’ve been working butts off for the last 12 months to reinvent Jovo for v4. So yes, I strongly hope it’s “at least better”.

We are going to release it this week, this is why everything is a bit slow. Jovo is open source though, so it’s always possible to help tackle the problems you encounter using this free software.

#5

Ok, guess it’s time to consider migrating. Apologies for giving you a hard time about this, but maintenance is one of the things folks want from a library they’re betting their product on. Your current users, I assume, are mostly personal projects, but when you start getting folks wanting to use this for “serious” work they’re going to be much less patient.

I’m starting to get almost comfortable enough in Jovo and node.js to consider starting to dive into the docs and source and pay back in more than a documented example.

#6

We just uploaded the migration guide. There are probably lots of potential improvements. Let us know if there is anything you’re missing: https://v4.jovo.tech/docs/migration-from-v3

#7

Many thanks. From the docs you had posted I could see what your intended restructuring was, but details weren’t obvious and I wasn’t looking forward to figuring it out by trial and error. This should help.

Have you rewritten the examples yet? If not I may be interested in attempting that, since I should go thru some of those exercises anyway to make sure I grok v4.

#8

Thanks, not yet. I’m going to record a v4 video tomorrow, but we won’t get around to migrating all the examples. They will follow soon

#9

Just to acknowledge the good work being done: my (mostly empty) jovov4 project reports only 8 moderate severity vulnerabilities after running npm audit fix. And the remaining issues seem to be SQL injection and XSS hazards, which are OK (though not ideal) if they apply to tools only being run during development. Much better, many thanks!