Update Dependencies

[binarymist]

SUT

• NodeGoat
  • Details to set-up NodeGoat
  • https://github.com/purpleteam-labs/purpleteam-iac-sut

System

• terraform (Terraform itself should be handled by the systems package manager)
  • https://releases.hashicorp.com/terraform/
  • https://www.terraform.io/downloads.html
  • https://www.hashicorp.com/security
  • https://www.terraform.io/upgrade-guides/0-13.html
  • https://github.com/hashicorp/terraform/blob/v0.13.5/CHANGELOG.md
  • purpleteam-iac
    • Update Terraform providers and versions.tf
      • terragrunt init -upgrade
      • terragrunt apply
    • Update AWS AMIs
    • Update Stage Two images
  • purpleteam-iac-sut
    • Update Terraform providers and versions.tf
      • terragrunt init -upgrade
      • terragrunt apply
    • Update AWS AMIs
• terragrunt
  • https://github.com/gruntwork-io/terragrunt/releases
• nvm
• Node
  • The main constrain is what AWS Lambda supports. Also the Terraform AWS provider may need updating
• docker-compose

Project

• purpleteam-logger
  • test via purpleteam-orchestraiter
  • test via purpleteam-app-scanner
  • publish to NPM and update orchestrator and app-scanner deps
  • test locally via cloud SUT
• mocksse
• purpleteam
  • gitlab-ci node version
  • code, lab
  • purpleteam-logger 1.0.1 - 1.0.2
  • request libs replaced
    • request
    • request-promise
    • request-promise-native
      Request's Past, Present and Future
      Alternative libraries to request
      Replaced with got
  • devDependencies
  • dependencies
  • test local
  • test local with cloud sut
  • test cloud
• purpleteam-lambda
  • test local
  • test local with cloud sut
  • test cloud
• purpleteam-orchestrator
  • Dockerfile node version
  • gitlab-ci node version
  • devDependencies
    • code, lab
    • eslint and friends
    • npm-check
    • pre-commit (no update)
    • rewire, sinon
  • dependencies
    • hapi-json-api
    • ajv and frineds
    • app-module-path (no update)
    • convict
    • diff
    • hapi 18->20
    • hapi-good-winston
    • good (is depricatedd, hapi needs to be upgraded at same time)
    • inert (hapi needs to be upgraded at same time)
    • joi
    • purpleteam-logger
    • redis
    • susie (no update)
    • wreck
  • test local
  • test local with cloud sut
  • test cloud
• purpleteam-app-scanner
  • Dockerfile node version
  • gitlab-ci node version
  • devDependencies
    • lab
    • eslint and friends
    • npm-check
    • pre-commit (no update)
    • rewire
    • sinon
  • dependencies
    • code
    • app-module-path (no update)
    • aws-sdk
    • axios
    • convict
    • cucumber
      • gherkin (currently required to support cucumber-redacted.js). Issue submitted, still waiting for response. Tracking this at Tickets to keep an eye on #13
    • good (is depricatedd, hapi needs to be upgraded at same time)
    • hapi 18->20
    • hapi-good-winston
    • http-proxy-agent (no update)
    • joi
    • purpleteam-logger
    • redis
    • selenium-webdriver (no update)
    • zaproxy (on latest commit)
      • zaproxy needs it's deps (request and friends) updated. Issue added.
  • test local
  • test local with cloud sut
  • test cloud
• purpleteam-s2-containers
  • Update Stage Two images
  • docker-compose 3.6 - 3.8 (dependant on docker-compose-ui). Can now be updated as we have a new maintainer/fork and it appears that 3.8 is now supported:
    • Upstream (archived): https://github.com/francescou/docker-compose-ui
    • https://github.com/nsano-rururu/docker-compose-ui Discuss issues in Github Discussions
  • test local

@hapi/good (API here) is deprecated. It doesn't actually do anything other than log process metrics (memory, uptime, load). All other logging is done by the generic hapi logger (server.log, request.log) or purpleteam-logger. good can stay until it no longer works, then we can just remove it along with hapi-good-winston.

• Replace instances of JSON.parse with Bourne.parse

Message on #hapi Slack from the BDFL on 2020-07-05:
eran 08:05
@channel hapi v18 will is being soft-deprecated. This means it will only get critical security fixed between now and the end of the year. No other bug fixes or node version updates will be released. It was supposed to be deprecated months ago but was postponed due to the COVID-19 situation. You will start seeing a deprecation message on npm now, and then it will no longer receive any support or security fixed at the end of the year. There is no reason not to upgrade to hapi v19. It is a trivial upgrade from v18
hapijs/hapi#4111

NPM tricks

Publish

Publish and create release notes