Like we have for composer.lock files, we should check libraries included in our node.js repos for known vulnerabilities and alert someone if issues are found.
There are two utilities that I know of to do the check,
Wikia is using retire.js. Requiresafe is newer (and has active backing), but it talks to a proprietary service for the checks. Requiresafe also doesn't require you to npm install before doing the check, which (as far as I've been able to make it work) retire.js does.
| Subject | Repo | Branch | Lines +/- | |
|---|---|---|---|---|
| Check for vulnerable libraries in all node.js repos | integration/config | master | +4 -0 |
| Status | Subtype | Assigned | Task | ||
|---|---|---|---|---|---|
| Resolved | None | T96078 Jenkins check for vulnerable libraries in all node.js repos | |||
| Resolved | Legoktm | T201633 Provide npm 6.0+ in CI environments |
Nice feature but one needs to figure out a way to grab all our repositories composer.json for all branches that are supported. Then run the script on each of them. A first step can be to run it for mediawiki extensions deployed on cluster + the backend services using the master and wmf branches.
No one is apparently actively working on this idea though. So that needs a volunteer to step in :-]
And for the record, this is for running a check on our node.js services, as opposed to checking composer. That's another task. :)
I've heard that we don't currently manage services in our CI infrastructure (although it looks like parsoid, and maybe cx server is there), that those are usually pulled from the repo directly to the cluster and deployed. Is that really the case? Or are we running jenkins jobs for most services?
Check out T78410: Move Parsoid and RESTBase testing from Travis CI to our Jenkins for more context / info.
Change 278571 had a related patch set uploaded (by Paladox):
Check for vulnerable libraries in all node.js repos
Change 278571 abandoned by Hashar:
Check for vulnerable libraries in all node.js repos
I think that is now covered by LibUp , it scans composer/npm repositories and does report vulnerability at https://libraryupgrader2.wmcloud.org/vulns/npm?branch=main . There is then some process to automatically generate package updates for the affected repositories.