Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Clean up frontend dependencies #578

Open
arkid15r opened this issue Jan 23, 2025 · 3 comments
Open

Clean up frontend dependencies #578

arkid15r opened this issue Jan 23, 2025 · 3 comments
Assignees
Labels

Comments

@arkid15r
Copy link
Collaborator

Is your feature request related to a problem? Please describe.
I'm aware of just one unused dependency -- axios.

Describe the solution you'd like
Identify and remove all unused frontend direct dependencies (for both dependencies and devDependencies sections)

@github-project-automation github-project-automation bot moved this to Backlog in Project Nest Jan 23, 2025
@arkid15r arkid15r removed the todo label Jan 23, 2025
@arkid15r arkid15r moved this from Backlog to Todo in Project Nest Jan 23, 2025
@shining-bluemoon-11
Copy link
Contributor

shining-bluemoon-11 commented Jan 23, 2025

@arkid15r I'd like to work on issue

i think , i have to use npm audit then i have to manually review the dependencies and devDependencies sections in package.json and then check them with the actual usage within the frontend n also have to inspect import n require and then remove the used one's from the package.json then run npm install to update the code
PLEASE let me know IF AM I GOING IN THE RIGHT DIRECTION , or IS THERE SOMETHING MISSING , if so i am eager to learn .
Thankyou .

@arkid15r
Copy link
Collaborator Author

The npm audit command is used to analyze the dependencies of a Node.js project for known security vulnerabilities. It scans your project's dependency tree and compares it against a database of publicly reported vulnerabilities. Here's what it does in detail:

Key Features of npm audit

  1. Dependency Scanning:

    • It checks all dependencies listed in your package.json file and their nested dependencies.
  2. Vulnerability Check:

    • It queries the npm public vulnerability database to see if any dependencies in your project are affected by known security issues.
  3. Audit Report:

    • It generates a detailed report showing:
      • Severity: Categorized as low, moderate, high, or critical.
      • Affected Package: The name of the vulnerable package.
      • Vulnerability Description: A brief explanation of the issue.
      • Path: The dependency chain leading to the vulnerable package.
      • Remediation: Instructions for resolving the issue, such as upgrading the package or replacing it.
  4. Interactive Fix:

    • Running npm audit fix automatically applies compatible updates to resolve the vulnerabilities.
    • Running npm audit fix --force applies updates even if they introduce breaking changes.
  5. Exit Codes:

    • The command returns an exit code:
      • 0 if no vulnerabilities are found.
      • 1 if vulnerabilities are found.

Example Output

When you run npm audit, you might see something like:

=== npm audit security report ===
# Run  npm install some-package@latest  to resolve 1 vulnerability
  High            Arbitrary File Overwrite
  Package         some-package
  Patched in      >=1.2.3
  Dependency of   my-app
  Path            my-app > some-package
  More info       https://npmjs.com/advisories/123

When to Use

  • Regular Maintenance: Periodically check your project for vulnerabilities.
  • Before Deployment: Ensure there are no security issues before releasing to production.
  • After Adding Dependencies: Run it after installing or updating dependencies to verify their security status.

@shining-bluemoon-11
Copy link
Contributor

@arkid15r Thank you , for assigning me this task. I'm excited to work on it

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
Status: Todo
Development

No branches or pull requests

2 participants