Skip to content

Update dependencies in A17 Toolkit fork#1

Open
andrewtf wants to merge 1 commit into
mainfrom
develop
Open

Update dependencies in A17 Toolkit fork#1
andrewtf wants to merge 1 commit into
mainfrom
develop

Conversation

@andrewtf

Copy link
Copy Markdown

I updated dependencies by running npm update and things were updated. I'm unclear on how we go about testing this so I'm kicking it over to @jonw-cogapp for his expert opinion.

@andrewtf andrewtf requested a review from jonw-cogapp February 24, 2026 18:09
@andrewtf

Copy link
Copy Markdown
Author

@jonw-cogapp somehow this got lost in the shuffle. Node-forge has been updated to 1.3.14 (needs to be >= 1.3.2) but I'm not really sure how we want to go about testing this.

@jonw-cogapp

Copy link
Copy Markdown
Collaborator

@andrewtf Seems like there's a lot of npm vulnerabilities in this repo. It seems like npm audit fix can fix about half of them, but it still leaves quite a lot of un-resolvable issues.

Fixing this here could be a can of worms, and I think directs effort into the wrong place. I'm not sure what / if any of the vulnarabilities are finding their way into bundled code (needs more time than I can give right here).

There's only one component that needs external dependencies, which is Modal. This is one which is used in the site unfortunately... I'm not sure if those external dependencies are part of the vulnerable packages.

Instead of continuing to support this repo, I think it's worth thinking about abandonning it and migrating the components we do use into the site. Probably a better use of our time, and tightens our control on this.

With all that being said: I think the risk of their being something actually exploitable in this front-end code within the context that it runs to be very unlikely, so we could also de-prioritise this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants