Some npm warnings incl. a "high severity vulnerability"

[eleses]

With the current git head and node 22 I get these warnings

npm warn deprecated inflight@1.0.6: This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.
npm warn deprecated bootstrap-growl@3.1.3: This project has been renamed to bootstrap-notify. Install using bootstrap-notify instead.
npm warn deprecated glob@7.2.3: Glob versions prior to v9 are no longer supported

added 226 packages, and audited 227 packages in 19s

21 packages are looking for funding
  run `npm fund` for details

1 high severity vulnerability

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

axios  <=0.29.0
Severity: high
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
fix available via `npm audit fix --force`
Will install axios@1.10.0, which is a breaking change

I suppose HSV doesn't really matter for local deployment, but the memory leak might.

Anyhow, it doesn't seem to work with node 22

node:internal/process/promises:392
      new UnhandledPromiseRejection(reason);
      ^

UnhandledPromiseRejection: This error originated either by throwing inside of an async function without a catch block, or by rejecting a promise which was not handled with .catch(). The promise rejected with the reason "#<DOMException>".
    at throwUnhandledRejectionsMode (node:internal/process/promises:392:7)
    at processPromiseRejections (node:internal/process/promises:475:17)
    at process.processTicksAndRejections (node:internal/process/task_queues:106:32) {
  code: 'ERR_UNHANDLED_REJECTION'
}

I can connect to http://localhost:1124/ but I get a brief red flash about failure to connect to the facet server. And sending any commands gives

error starting transport server: Error: connect ECONNREFUSED 127.0.0.1:3211

Etc.

What's the latest version of node this is known to work with? Still 14 like the README says?

Interestingly, I had no trouble running a local copy of wax though, including the facet example, which uses the bundled version.

I guess I need to see what's going on with that socket. I think the Windows firewall blocks non-interactive programs and those can't even display the question about letting them through. I got one for the main http port, but not for the transport. I'll try on linux later.

As far as facet on Windows is concerned, I'm giving up. I turned off the firewall completely, but I get the same UnhandledPromiseRejection and in the browser console:

[nnirror]

Sorry this has taken me so long to acknowledge. I started a new job over the summer and have had less time to work on Facet. I will address this when I get more bandwidth.

[nnirror]

@eleses Thanks again for your questions!

Sorry it took me a bit to address them.

1. npm high severity vulnerability

I have updgraded to the latest version of axios, so this is resolved.

2. Node version

I am running on node v22.21.1 and am not seeing any issues. Were your issues specifically happening on Windows machines?

3. npm warnings

One of the npm packages (bootstrap-growl@3.1.3) wasn't being used, so I removed it.

The other two warnings (inflight, glob) are transitive dependencies from jshint, so I am not able to update them myself. Down the road, I do think it is a good idea to update to a newer codemirror version. When i do that, this dependency issue will go away.

4. Running on Windows

It has been a while since I tested on Windows. Unfortunately, I don't have the time to dedicate to that right now. It certainly was working at one point, but the firewall did need to be manually circumvented. I will ask to see if other Windows users can recreate this issue.