Skip to content
This repository has been archived by the owner on Apr 6, 2021. It is now read-only.

Upgraded bower to 1.8.8 and grunt-groc to 0.7.1 #29

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Upgraded bower to 1.8.8 and grunt-groc to 0.7.1 #29

wants to merge 1 commit into from

Conversation

rocklan
Copy link

@rocklan rocklan commented Aug 6, 2020

This is a fix for #28 and fixes the bower dependency issue. Unfortunately, it looks like grunt-groc has a dependency tree of grunt-groc > groc > jade > constantinople, and the version of constantinople referenced has a critical security vulnerability https://www.npmjs.com/advisories/568. It looks like grunt-groc has a pull request for this - jdcataldo/grunt-groc#22 - but I think grunt-groc isn't being maintained anymore. I'm not sure if grunt-groc is needed or how to replace it, I'll have a look at it a bit later if I can.

I can't test this fix properly - it's not building on my mac and the tests don't run on windows, but I'm pretty sure it should continue to work ok.

I agree with @kwwall - unless this vuln can be fixed, I would stick up a "Do NOT use!" warning unless someone more experienced than me can fix it.

@xeno6696
Copy link

xeno6696 commented Aug 6, 2020 via email

@rocklan
Copy link
Author

rocklan commented Aug 6, 2020

How important is the grunt-groc task? It sounds to me like that particular library is unique to the grunt build process and won’t be included in the final package?

I'm really not sure. Need to get someone who is more familiar with npm+grunt than me.

@deveras
Copy link

deveras commented Aug 6, 2020

Groc: A simple grunt task to generate a project's documentation using Groc
https://github.com/ESAPI/owasp-esapi-js/blob/master/tasks/groc.js holds the task that listens to any files under /lib (which I didn't seen in the project) and will output to a /docs folder. Perhaps "David Morse" can add the reasoning behind it.

@xeno6696
Copy link

xeno6696 commented Aug 6, 2020 via email

@kwwall
Copy link
Contributor

kwwall commented Mar 24, 2021

@chrisisbeef - This is your project and know one that I've found knows about the deployment. If we can't get this fixed, I am seriously considering updating the README.md to say "Do not use" and then 'archiving this repository' so that it is read-only. So, can you please respond? Thanks.

@chrisisbeef
Copy link
Member

Hey guys - this project is woefully out of date at this point (having gone through and reviewed a lot of this code) and I think honestly the best course of action would be to EoL the project completely. There are much better solutions that are provided by most modern frameworks to handle this on the client-side IMO.

@kwwall
Copy link
Contributor

kwwall commented Apr 6, 2021

Leaving this PR open in case someone volunteers to take this repo over and get it working.
@chrisisbeef - Recommend you deprecate this by running the appropriate 'npm deprecate' command as outlined in my email. (I am not the owner and therefore cannot do that.)

I am now going to officially archive this GitHub repo.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
5 participants
@rocklan @xeno6696 @deveras @kwwall @chrisisbeef