Please update dependancies

[vkumov]

During installation of the framework I get the following warnings:

npm WARN deprecated [email protected]: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.
npm WARN deprecated [email protected]: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated [email protected]: this library is no longer supported

Further investigation shows that [email protected] relies on core-js:

❯ npm ls core-js
...
└─┬ [email protected]
  └─┬ [email protected]
    ├─┬ @webex/[email protected]
    │ └─┬ [email protected]
    │   └── [email protected]  deduped
    └─┬ [email protected]
      └── [email protected] 

and @webex/[email protected] relies on request:

❯ npm ls request
...
└─┬ [email protected]
  └─┬ [email protected]
    └─┬ @webex/[email protected]
      └─┬ @webex/[email protected]
        └── [email protected] 

It would be great to update dependancies and not to use deprecated packages.
Thank you.

[jpjpjp]

Hi @vkumov thanks for bringing this up. These are coming from one of my dependencies. I'll raise an issue on the webex sdk.

[master-hax]

Hi @jpjpjp any update on this?

[jpjpjp]

I'm no longer seeing these warnings on fresh checkouts and npm install on both the framework and the webex-bot-starter sample project built on this framework. @master-hax or @vkumov can either of you confirm that this is no longer an issue?

[vkumov]

@jpjpjp

Yes, when install webex-node-bot-framework separately (assuming that webex is installed already - there are no warnings :)
However if installing all together - there are still quite a lot of warnings.
But, my bad - that's an issue with webex package itself, not webex-node-bot-framework. I'll open issue there to update dependancies

[ccandreva]

Having just cloned this project, npm start finds 42 vulnerabilities, this is the report:

# npm audit report

@webex/webex-core  *
Severity: moderate
Depends on vulnerable versions of jsonwebtoken
Depends on vulnerable versions of jsonwebtoken - null
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/@webex/webex-core
  @webex/internal-plugin-calendar  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-encryption
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-calendar
  @webex/internal-plugin-conversation  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-encryption
  Depends on vulnerable versions of @webex/internal-plugin-user
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-conversation
    @webex/plugin-meetings  >=1.80.143
    Depends on vulnerable versions of @webex/internal-plugin-conversation
    Depends on vulnerable versions of @webex/internal-plugin-mercury
    Depends on vulnerable versions of @webex/webex-core
    node_modules/@webex/plugin-meetings
  @webex/internal-plugin-device  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-metrics
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-device
  @webex/internal-plugin-encryption  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-encryption
  @webex/internal-plugin-feature  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-feature
  @webex/internal-plugin-lyra  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-encryption
  Depends on vulnerable versions of @webex/internal-plugin-feature
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-lyra
  @webex/internal-plugin-mercury  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-feature
  Depends on vulnerable versions of @webex/internal-plugin-metrics
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-mercury
  @webex/internal-plugin-metrics  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-metrics
  @webex/internal-plugin-presence  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-presence
  @webex/internal-plugin-search  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-encryption
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-search
  @webex/internal-plugin-support  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-support
    webex  >=1.80.143
    Depends on vulnerable versions of @webex/internal-plugin-calendar
    Depends on vulnerable versions of @webex/internal-plugin-device
    Depends on vulnerable versions of @webex/internal-plugin-presence
    Depends on vulnerable versions of @webex/internal-plugin-support
    Depends on vulnerable versions of @webex/plugin-attachment-actions
    Depends on vulnerable versions of @webex/plugin-authorization
    Depends on vulnerable versions of @webex/plugin-device-manager
    Depends on vulnerable versions of @webex/plugin-logger
    Depends on vulnerable versions of @webex/plugin-meetings
    Depends on vulnerable versions of @webex/plugin-memberships
    Depends on vulnerable versions of @webex/plugin-messages
    Depends on vulnerable versions of @webex/plugin-people
    Depends on vulnerable versions of @webex/plugin-rooms
    Depends on vulnerable versions of @webex/plugin-team-memberships
    Depends on vulnerable versions of @webex/plugin-teams
    Depends on vulnerable versions of @webex/plugin-webhooks
    Depends on vulnerable versions of @webex/storage-adapter-local-storage
    Depends on vulnerable versions of @webex/webex-core
    node_modules/webex
      webex-node-bot-framework  >=1.2.1
      Depends on vulnerable versions of webex
      node_modules/webex-node-bot-framework
  @webex/internal-plugin-user  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-user
  @webex/plugin-attachment-actions  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-attachment-actions
  @webex/plugin-authorization-browser  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-authorization-browser
    @webex/plugin-authorization  >=1.80.143
    Depends on vulnerable versions of @webex/plugin-authorization-browser
    Depends on vulnerable versions of @webex/plugin-authorization-node
    node_modules/@webex/plugin-authorization
  @webex/plugin-authorization-node  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-authorization-node
  @webex/plugin-device-manager  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-lyra
  Depends on vulnerable versions of @webex/internal-plugin-search
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-device-manager
  @webex/plugin-logger  >=1.80.143
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-logger
  @webex/plugin-memberships  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-memberships
  @webex/plugin-messages  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-messages
  @webex/plugin-people  >=1.80.143
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-people
  @webex/plugin-rooms  >=1.80.143
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-rooms
  @webex/plugin-team-memberships  >=1.80.143
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-team-memberships
  @webex/plugin-teams  >=1.80.143
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-teams
  @webex/plugin-webhooks  >=1.80.143
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-webhooks
  @webex/storage-adapter-local-storage  >=1.80.143
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/storage-adapter-local-storage

@xmldom/xmldom  <0.7.7
Severity: critical
xmldom allows multiple root nodes in a DOM - https://github.com/advisories/GHSA-crh6-fp67-6883
fix available via `npm audit fix`
node_modules/@xmldom/xmldom

decode-uri-component  <0.2.1
decode-uri-component vulnerable to Denial of Service (DoS) - https://github.com/advisories/GHSA-w573-4hg7-7wgq
fix available via `npm audit fix`
node_modules/decode-uri-component

json5  <1.0.2 || >=2.0.0 <2.2.2
Severity: high
Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h
fix available via `npm audit fix`
node_modules/@babel/core/node_modules/json5
node_modules/find-babel-config/node_modules/json5
node_modules/json5
  find-babel-config  <=1.2.0
  Depends on vulnerable versions of json5
  node_modules/find-babel-config
    babel-plugin-module-resolver  2.3.0 - 4.1.0
    Depends on vulnerable versions of find-babel-config
    node_modules/babel-plugin-module-resolver
      babel-preset-expo  *
      Depends on vulnerable versions of babel-plugin-module-resolver
      node_modules/babel-preset-expo
        expo  >=14.0.0
        Depends on vulnerable versions of babel-preset-expo
        node_modules/expo

jsonwebtoken  <=8.5.1
Severity: high
jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC - https://github.com/advisories/GHSA-hjrf-2m68-5959
jsonwebtoken unrestricted key type could lead to legacy keys usage  - https://github.com/advisories/GHSA-8cf7-32gw-wr33
jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify() - https://github.com/advisories/GHSA-qwph-4952-7xr6
jsonwebtoken has insecure input validation in jwt.verify function - https://github.com/advisories/GHSA-27h2-hvpr-p74q
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/jsonwebtoken

qs  6.7.0 - 6.7.2
Severity: high
qs vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-hrpp-h998-j3pp
fix available via `npm audit fix`
node_modules/qs
  body-parser  1.19.0
  Depends on vulnerable versions of qs
  node_modules/body-parser
    @expo/dev-server  <=0.1.123
    Depends on vulnerable versions of body-parser
    node_modules/@expo/dev-server
  express  4.17.0 - 4.17.1 || 5.0.0-alpha.1 - 5.0.0-alpha.8
  Depends on vulnerable versions of body-parser
  Depends on vulnerable versions of qs
  node_modules/express

42 vulnerabilities (1 low, 30 moderate, 10 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

[riekan]

Same here:

Will install [email protected], which is a breaking change
node_modules/@webex/webex-core
  @webex/internal-plugin-calendar  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-encryption
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-calendar
  @webex/internal-plugin-conversation  *
  Depends on vulnerable versions of @webex/helper-image
  Depends on vulnerable versions of @webex/internal-plugin-encryption
  Depends on vulnerable versions of @webex/internal-plugin-user
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-conversation
    @webex/plugin-meetings  1.80.143 - 2.48.0 || >=3.0.0-beta.0
    Depends on vulnerable versions of @webex/internal-plugin-conversation
    Depends on vulnerable versions of @webex/internal-plugin-mercury
    Depends on vulnerable versions of @webex/webex-core
    node_modules/@webex/plugin-meetings
  @webex/internal-plugin-device  *
  Depends on vulnerable versions of @webex/http-core
  Depends on vulnerable versions of @webex/internal-plugin-metrics
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-device
    @webex/internal-plugin-metrics  1.80.143 - 2.48.0 || >=3.0.0-beta.0
    Depends on vulnerable versions of @webex/internal-plugin-device
    Depends on vulnerable versions of @webex/webex-core
    node_modules/@webex/internal-plugin-metrics
  @webex/internal-plugin-encryption  *
  Depends on vulnerable versions of @webex/http-core
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-encryption
  @webex/internal-plugin-feature  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-feature
  @webex/internal-plugin-lyra  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-encryption
  Depends on vulnerable versions of @webex/internal-plugin-feature
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-lyra
  @webex/internal-plugin-mercury  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-feature
  Depends on vulnerable versions of @webex/internal-plugin-metrics
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-mercury
  @webex/internal-plugin-presence  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-presence
  @webex/internal-plugin-search  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-encryption
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-search
  @webex/internal-plugin-support  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-support
    webex  1.80.143 - 2.48.0 || >=3.0.0-beta.0
    Depends on vulnerable versions of @webex/internal-plugin-calendar
    Depends on vulnerable versions of @webex/internal-plugin-device
    Depends on vulnerable versions of @webex/internal-plugin-presence
    Depends on vulnerable versions of @webex/internal-plugin-support
    Depends on vulnerable versions of @webex/plugin-attachment-actions
    Depends on vulnerable versions of @webex/plugin-authorization
    Depends on vulnerable versions of @webex/plugin-device-manager
    Depends on vulnerable versions of @webex/plugin-logger
    Depends on vulnerable versions of @webex/plugin-meetings
    Depends on vulnerable versions of @webex/plugin-memberships
    Depends on vulnerable versions of @webex/plugin-messages
    Depends on vulnerable versions of @webex/plugin-people
    Depends on vulnerable versions of @webex/plugin-rooms
    Depends on vulnerable versions of @webex/plugin-team-memberships
    Depends on vulnerable versions of @webex/plugin-teams
    Depends on vulnerable versions of @webex/plugin-webhooks
    Depends on vulnerable versions of @webex/storage-adapter-local-storage
    Depends on vulnerable versions of @webex/webex-core
    node_modules/webex
      webex-node-bot-framework  >=1.2.1
      Depends on vulnerable versions of webex
      node_modules/webex-node-bot-framework
  @webex/internal-plugin-user  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/internal-plugin-user
  @webex/plugin-attachment-actions  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-attachment-actions
  @webex/plugin-authorization-browser  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-authorization-browser
  @webex/plugin-authorization-node  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-authorization-node
    @webex/plugin-authorization  1.80.143 - 2.48.0 || >=3.0.0-beta.0
    Depends on vulnerable versions of @webex/plugin-authorization-browser
    Depends on vulnerable versions of @webex/plugin-authorization-node
    node_modules/@webex/plugin-authorization
  @webex/plugin-device-manager  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-device
  Depends on vulnerable versions of @webex/internal-plugin-lyra
  Depends on vulnerable versions of @webex/internal-plugin-search
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-device-manager
  @webex/plugin-logger  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-logger
  @webex/plugin-memberships  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-memberships
  @webex/plugin-messages  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-messages
  @webex/plugin-people  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-people
  @webex/plugin-rooms  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/internal-plugin-conversation
  Depends on vulnerable versions of @webex/internal-plugin-mercury
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-rooms
  @webex/plugin-team-memberships  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-team-memberships
  @webex/plugin-teams  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-teams
  @webex/plugin-webhooks  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/plugin-webhooks
  @webex/storage-adapter-local-storage  1.80.143 - 2.48.0 || >=3.0.0-beta.0
  Depends on vulnerable versions of @webex/webex-core
  node_modules/@webex/storage-adapter-local-storage

[jpjpjp]

Hi @riekan and @ccandreva. Virtually all of the dependencies that cause vulnerabilities come from the webex/webex-js-sdk: JavaScript SDK for Webex, which is maintained by Cisco and no longer allows for public PRs.

npm audit --fix attempts to fix these issues by reverting the webex-js-sdk to the 1.0 version, which does not support webhooks and will not work with the framework. The only way to address these vulnerabilities is to make changes in the SDK itself. To that end, I urge you to go to New Issue · webex/webex-js-sdk and open a case with the SDK team. The more people that do this, the more likely it is that this work gets prioritized.

In the meantime, whenever a PR like this gets opened (or commented on), I spend several hours looking into what I can do to minimize the warnings by manually tweaking the package.json overrides section, and doing multiple clean installs and tests.

After doing this today, I have reduced the number of moderate security vulnerability warnings from 47 to 37. To be honest, I'm not sure it is even worth it to run the full test suite, submit a PR with these changes and update the framework version. It will add no new functionality, and there are still vulnerabilities. (I will do this if anyone specifically requests me to).

I am NOT, however, going to try to do this anymore. I will still attempt to address issues in the framework itself, and consider feature requests, but I cannot spend any more time trying to address JS SDK security vulnerabilities. My only advice for developers who do not wish to build bots that have security vulnerabilities would be to build it directly on top of the Webex API or to use a framework that does not rely on the Webex JSSDK.

If anyone else is interested in continuing the work of doing bandaid overrides on a dependency-by-dependency basis, reach out to me directly and I'll provide some notes on how I've attempted to do this in the past.