suculent / thinx-device-api / ef381fe4-eef8-4554-8b26-6c4b634011ec

73%

master: 14%

push

circleci

Security fixes (#577)

* fix(test): revoke GitHub SSH keys after integration tests

* fix(deps): clear npm audit findings in the API

- npm audit fix: body-parser 2.4.0/1.20.9, fast-uri 3.1.9, follow-redirects
  1.16.2, ip-address 10.7.5, node-forge 1.4.2, qs, undici 7.30.1
- node-forge ^1.4.2 and serialize-javascript override ^7.1.3, so a fresh
  resolution cannot fall back below the fixed versions
- base submodule: same fixes for the base package set

npm audit: 9 -> 0 (lockfile and fresh resolution, with and without dev).

* build: install API and Vue console dependencies from tracked lockfiles

The API image copied only package.json (package-lock.json was even in
.dockerignore) and ran `npm install`, so it shipped whatever the ranges
resolved to on build day instead of the audited lockfile. Dockerfile and
Dockerfile.test now copy package-lock.json and run `npm ci`.

services/console: dependency upgrades (gulp-inject-envs removed, unused Vue
deps dropped, yarn resolutions) and vue/yarn.lock tracked; test-vue-console
installs with `yarn install --frozen-lockfile`.

* ci: stop deleting package-lock.json before the API test and image builds

The test job and build-api-cloud both ran `rm -rf ./package-lock.json`
before building, so the new `COPY package.json package-lock.json` in
Dockerfile/Dockerfile.test failed with "/package-lock.json: not found".

* fix(nodemcu-docker-build): security fix

5327 of 7819 branches covered (68.13%)

Branch coverage included in aggregate %.

23 of 23 new or added lines in 1 file covered. (100.0%)

8057 of 10580 relevant lines covered (76.15%)

67.81 hits per line