Add nsp support to all packages & plugins.

[marshallswain]

I think it's a good idea to add this into the build/publishing process so we get alerts of vulnerabilities that pop up. What do you guys think? @feathersjs/core-team
https://nodesecurity.io/tools

We need to do this to each of these:

• feathers
• feathers-commons Add NSP check to test script. feathersjs-ecosystem/commons#16
• feathers-rest Adding nsp check feathersjs-ecosystem/feathers-rest#8
• feathers-socketio Adding nsp check feathersjs-ecosystem/socketio#6
• feathers-primus Adding nsp check feathersjs-ecosystem/primus#4
• feathers-socket-commons Adding nsp check feathersjs-ecosystem/transport-commons#1
• feathers-mongodb Adding nsp check feathersjs-ecosystem/feathers-mongodb#19
• feathers-mongoose Accidentally committed directly. Wrong key command. 🙃
• feathers-authentication Adding nsp check feathersjs-ecosystem/authentication#26
• feathers-client Adding nsp check feathersjs-ecosystem/client#24
• feathers-nedb Adding nsp check feathersjs-ecosystem/feathers-nedb#10 (error)
• feathers-memory Adding nsp check feathersjs-ecosystem/feathers-memory#12
• feathers-sequelize Adding nsp check feathersjs-ecosystem/feathers-sequelize#10
• feathers-knex Adding nsp check feathersjs-ecosystem/feathers-knex#27
• feathers-waterline Adding nsp check feathersjs-ecosystem/feathers-waterline#3
• feathers-query-filters Adding nsp check feathersjs-ecosystem/feathers-query-filters#7
• feathers-configuration Adding nsp check feathersjs-ecosystem/configuration#1

[ekryski]

👍 I haven't use nsp before but sounds like a good idea to me.

[daffl]

That sounds good. Can you run nsp against this repo and show how it looks?

[daffl]

Did you get a chance to test it out? I would figure that all we need to do is add it as an NPM script.

[marshallswain]

Nope. I didn't try it out, yet. I'll try it now.

[marshallswain]

[marshallswain]

It looks like they currently only make it easy to use a command line utility, but the gulp-nsp project shows how we could create an npm script to run the nsp package: https://github.com/nodesecurity/gulp-nsp/blob/master/index.js

[daffl]

Why couldn't you just install the command line as a devDependency and run it from an NPM script?

[marshallswain]

Oh yeah. Yep it works: ./node_modules/.bin/nsp check

[daffl]

As an npm script you won't even have to add node_modules/.bin.

[marshallswain]

You're right. Where's the best place to integrate it? At the end of test?

[marshallswain]

"test": "npm run compile && npm run jshint && npm run mocha && npm run nsp",

[marshallswain]

Actually, running it directly works "test": "npm run compile && npm run jshint && npm run mocha && nsp check",

It doesn't need the extra script.

[marshallswain]

I copied the list to the first comment. We've only updated feathers core, so far.

[marshallswain]

All plugins have a PR.

[ekryski]

@marshallswain what's the issue with nedb? Would be nice to close this issue out.

[marshallswain]

Looks like @daffl fixed it.

[ekryski]

👍

[lock]

This issue has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue with a link to this issue for related bugs.