Skip to content

Commit e3a8e82

Browse files
lholmquistlholmquist
authored
chore: add npcheck Q3 review (#171)
* chore: add npcheck Q3 review * squash: more context about the fix for the CI failure * chore: also needed to add another license that got added during the code review
1 parent 70059a4 commit e3a8e82

3 files changed

Lines changed: 151 additions & 3 deletions

File tree

‎npcheck-review/npcheck-jul1-2024.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -130,4 +130,4 @@ Aging
130130
(12): The latest release of "helmet" was 8 months ago
131131
(20): The latest release of "i18next-fs-backend" was 7 months ago
132132
(24): The latest release of "passport" was 7 months ago
133-
(35): The latest release of "nano" was 8 months ago
133+
(35): The latest release of "nano" was 8 months ago

‎npcheck-review/npcheck-oct11-2024.md‎

Lines changed: 147 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,147 @@
1+
# npcheck review - October 11 2024
2+
3+
4+
5+
## Diff in npcheck.json since last review
6+
7+
```shell
8+
@@ -498,7 +498,7 @@
9+
diff --git a/npcheck.json b/npcheck.json
10+
index 1f65eff..761845b 100644
11+
--- a/npcheck.json
12+
+++ b/npcheck.json
13+
@@ -450,7 +450,9 @@
14+
"BSD-3-Clause",
15+
"Unlicense",
16+
"WTFPL",
17+
- "Unicode-DFS-2016"
18+
+ "Unicode-DFS-2016",
19+
+ "Unicode-3.0",
20+
+ "BlueOak-1.0.0"
21+
],
22+
"rules": {
23+
"ioredis": {
24+
@@ -496,7 +498,7 @@
25+
"swagger-editor": {
26+
"note": "Multiple dependencies use licenses",
27+
"note": "depends on jsonify which is under Public Domain",
28+
- "allow": ["Python-2.0","0BSD", "Public Domain"]
29+
+ "allow": ["Python-2.0","0BSD", "Public Domain", "CC0-1.0"]
30+
},
31+
"@stoplight/prism-cli":{
32+
"note": "dependency tslib@2.3.1 reports 0BSD which is less restrictive than BSD",
33+
```
34+
35+
## Results
36+
37+
https://github.com/nodeshift/nodejs-reference-architecture/actions/runs/11197720660
38+
39+
40+
NPCheck Report
41+
42+
```shell
43+
NPCheck Report
44+
(1): The module "node-rdkafka" seems to have no available TypeScript typings.
45+
(2): The "cldr-localenames-full" seems that is lacking appropriate testing (https://www.github.com/unicode-cldr/cldr-json)
46+
(3): The module "cldr-localenames-full" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
47+
(4): The module "cldr-localenames-full" seems to have no available TypeScript typings.
48+
(5): The module "eslint" has "83" dependencies (including sub-dependencies) which is more than the default "20".
49+
(6): The module "express" seems to have no available TypeScript typings.
50+
(7): The module "express" has "62" dependencies (including sub-dependencies) which is more than the default "20".
51+
(8): The latest release of "express-prom-bundle" was 9 months ago
52+
(9): The module "express-prom-bundle" has "80" dependencies (including sub-dependencies) which is more than the default "20".
53+
(10): The latest release of "ibmcloud-appid" was over 1 year ago
54+
(11): The module "ibmcloud-appid" has "226" dependencies (including sub-dependencies) which is more than the default "20".
55+
(12): The module "i18next" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
56+
(13): The module "i18next" is not tested by community CITGM runs.
57+
(14): The latest release of "i18next-icu" was over 1 year ago
58+
(15): The module "i18next-icu" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
59+
(16): The module "i18next-http-middleware" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
60+
(17): The module "i18next-fs-backend" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
61+
(18): The module "ioredis" is not tested by community CITGM runs.
62+
(19): The module "opossum" seems to have no available TypeScript typings.
63+
(20): The latest release of "passport" was 11 months ago
64+
(21): The module "passport" seems to have no available TypeScript typings.
65+
(22): The module "pino" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
66+
(23): The module "pino" has "22" dependencies (including sub-dependencies) which is more than the default "20".
67+
(24): The module "rhea" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
68+
(25): The module "lru-cache" has no support for the LTS version(s) 18.20.4 of Node.js.
69+
(26): The module "mocha" seems to have no available TypeScript typings.
70+
(27): The module "mocha" has "69" dependencies (including sub-dependencies) which is more than the default "20".
71+
(28): The "jest" seems that is lacking appropriate testing (https://www.github.com/jestjs/jest)
72+
(29): The module "jest" has "260" dependencies (including sub-dependencies) which is more than the default "20".
73+
(30): The module "@ibm-cloud/cloudant" has "54" dependencies (including sub-dependencies) which is more than the default "20".
74+
(31): The module "nano" has "25" dependencies (including sub-dependencies) which is more than the default "20".
75+
(32): The module "odbc" has "56" dependencies (including sub-dependencies) which is more than the default "20".
76+
(33): The latest release of "ibm_db" was 6 months ago
77+
(34): The module "ibm_db" seems to have no available TypeScript typings.
78+
(35): The module "ibm_db" has "45" dependencies (including sub-dependencies) which is more than the default "20".
79+
(36): The module "mongodb" is not tested by community CITGM runs.
80+
(37): The module "pg" seems to have no available TypeScript typings.
81+
(38): The module "pg" is not tested by community CITGM runs.
82+
(39): The latest release of "kafkajs" was over 1 year ago
83+
(40): The module "@openapitools/openapi-generator-cli" depends on the "path-scurry@1.11.1" package which is under the non-acceptable license "BlueOak-1.0.0". - ERROR
84+
(41): The "@openapitools/openapi-generator-cli" seems that is lacking appropriate testing (https://www.github.com/OpenAPITools/openapi-generator-cli)
85+
(42): The module "@openapitools/openapi-generator-cli" seems to have no available TypeScript typings.
86+
(43): The module "@openapitools/openapi-generator-cli" has "109" dependencies (including sub-dependencies) which is more than the default "20".
87+
(44): The module "openapi-backend" has "34" dependencies (including sub-dependencies) which is more than the default "20".
88+
(45): The module "@stoplight/prism-cli" is not tested by community CITGM runs.
89+
(46): The module "@stoplight/prism-cli" has "174" dependencies (including sub-dependencies) which is more than the default "20".
90+
(47): The module "express-openapi-validator" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
91+
(48): The module "express-openapi-validator" has "108" dependencies (including sub-dependencies) which is more than the default "20".
92+
(49): The module "swagger-editor" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
93+
(50): The module "swagger-editor" seems to have no available TypeScript typings.
94+
(51): The module "swagger-editor" has "375" dependencies (including sub-dependencies) which is more than the default "20".
95+
(52): The latest release of "openapi-editor" was almost 4 years ago
96+
(53): The module "openapi-editor" has "196" dependencies (including sub-dependencies) which is more than the default "20".
97+
(54): The module "nyc" seems to have no available TypeScript typings.
98+
(55): The module "nyc" is not tested by community CITGM runs.
99+
(56): The module "nyc" has "141" dependencies (including sub-dependencies) which is more than the default "20".
100+
(57): The latest release of "dotenv" was 8 months ago
101+
(58): The module "dotenv" is not tested by community CITGM runs.
102+
(59): The latest release of "node-vault" was about 1 year ago
103+
(60): The module "node-vault" seems to have no available TypeScript typings.
104+
(61): The module "node-vault" is not tested by community CITGM runs.
105+
(62): The module "node-vault" has "59" dependencies (including sub-dependencies) which is more than the default "20".
106+
(63): The module "@ibm-cloud/secrets-manager" seems to have no available TypeScript typings.
107+
(64): The module "@ibm-cloud/secrets-manager" is not tested by community CITGM runs.
108+
(65): The module "@ibm-cloud/secrets-manager" has "53" dependencies (including sub-dependencies) which is more than the default "20".
109+
(66): The module "@opentelemetry/sdk-trace-base" is not tested by community CITGM runs.
110+
(67): The module "@opentelemetry/sdk-trace-node" is not tested by community CITGM runs.
111+
(68): The module "axios" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js.
112+
(69): The module "axios" is not tested by community CITGM runs.
113+
(70): The latest release of "node-fetch" was about 1 year ago
114+
(71): The module "node-fetch" is not tested by community CITGM runs.
115+
(72): The latest release of "cors" was almost 6 years ago
116+
(73): The module "cors" seems to have no available TypeScript typings.
117+
(74): The module "cors" is not tested by community CITGM runs.
118+
119+
problems: 74 (errors: 1 - warnings: 73)
120+
```
121+
122+
123+
New (materially) since last review (excluding ones were # deps was already over limit and changed):
124+
```
125+
None
126+
```
127+
## Notes
128+
129+
There was a release of Helmet since the last report. It had been 8 months since the last one
130+
131+
There was a release of Helmet since the last report. It had been 7 months since the last one
132+
133+
There was a release of Helmet since the last report. It had been 8 months since the last one
134+
135+
(40): The module "@openapitools/openapi-generator-cli" depends on the "path-scurry@1.11.1" package which is under the non-acceptable license "BlueOak-1.0.0". - ERROR
136+
137+
The latest release of `@openapitools/openapi-generator-cli` added the `glob` module which includes `path-scurry` which had a license(BlueOak-1.0.0) that was not in the list. It has now been added to the list. The "Due Dilligence" action is now green after adding this in.
138+
139+
The latest release of swagger-editor depends on react-syntax-highlighter, which just added a new dependecy, highlightjs-vue, which has a license that was not previously in the list(CC0-1.0)
140+
141+
A few modules are `aging` in terms of the last release. Not necessariliy something to worry about yet but worth keeping an eye on
142+
143+
Aging
144+
((20): The latest release of "passport" was 11 months ago
145+
(59): The latest release of "node-vault" was about 1 year ago
146+
(70): The latest release of "node-fetch" was about 1 year ago
147+

‎npcheck.json‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -451,7 +451,8 @@
451451
"Unlicense",
452452
"WTFPL",
453453
"Unicode-DFS-2016",
454-
"Unicode-3.0"
454+
"Unicode-3.0",
455+
"BlueOak-1.0.0"
455456
],
456457
"rules": {
457458
"ioredis": {
@@ -497,7 +498,7 @@
497498
"swagger-editor": {
498499
"note": "Multiple dependencies use licenses",
499500
"note": "depends on jsonify which is under Public Domain",
500-
"allow": ["Python-2.0","0BSD", "Public Domain"]
501+
"allow": ["Python-2.0","0BSD", "Public Domain", "CC0-1.0"]
501502
},
502503
"@stoplight/prism-cli":{
503504
"note": "dependency tslib@2.3.1 reports 0BSD which is less restrictive than BSD",

0 commit comments

Comments
 (0)