Critical vulnerability in socket.io-parser

[jattasNI]

🧹 Tech Debt

npm audit started failing due to a new critical vulnerability in socket.io-parser. This blocks the main PR workflow.

The package is pulled in by karma and @11y/eleventy:

• eleventy has fixed a similar issue in the past but I haven't seen a discussion of this vulnerability yet
• karma has an issue to track the vulnerability but no fix yet

npm ls socket.io-parser

├─┬ @ni/[email protected] -> ./packages/nimble-components
│ └─┬ [email protected]
│   └─┬ [email protected]
│     └── [email protected]
└─┬ @ni/[email protected] -> ./packages/site
  └─┬ @11ty/[email protected]
    └─┬ [email protected]
      ├─┬ [email protected]
      │ └─┬ [email protected]
      │   └── [email protected]
      └─┬ [email protected]
        └── [email protected]

[rajsite]

@fredvisser does Snyk replace the functionality that npm audit provided? If so then the action for this issue is to remove the audit steps from main.yml. Marking as "discussion" to see if we can make this issue go away.

[fredvisser]

Snyk doesn't support monorepos by default, so isn't picking up any of the package specific package.json files. So the current setup isn't good enough.
While they have a CLI flag that will find the other package.json files, we're using a web hook which doesn't appear to expose the option.

We could switch to a their Github Action or we could add the Github Dependency Review Action which would keep the workflow entirely with Github.

[rajsite]

Fixed in #1930

[rajsite]

@fredvisser looking at the dependency review check instructions it says to check the following page: https://github.com/ni/nimble/security/dependabot

where there I see non-dismissed critical vulns, but it doesn't look like dependency review check is complaining about those, see build:
https://github.com/ni/nimble/actions/runs/8439038563

and log:
https://github.com/ni/nimble/actions/runs/8439038563/job/23112684298#step:3:8

Edit: Ohhh, it maybe is only detecting dependency changes based on the README: https://github.com/actions/dependency-review-action?tab=readme-ov-file#dependency-review-action

So that's great and it might be working fine. I'll re-close the issue