|
| 1 | +# npcheck review - Oct 10 2023 |
| 2 | + |
| 3 | +No major concerns were noted in this review. |
| 4 | + |
| 5 | +## Diff in npcheck.json since last review |
| 6 | + |
| 7 | +```shell |
| 8 | +diff --git a/npcheck.json b/npcheck.json |
| 9 | +index 4a9bb4b..d220594 100644 |
| 10 | +--- a/npcheck.json |
| 11 | ++++ b/npcheck.json |
| 12 | +@@ -495,7 +495,8 @@ |
| 13 | + }, |
| 14 | + "swagger-editor": { |
| 15 | + "note": "Multiple dependencies use licenses", |
| 16 | +- "allow": ["Python-2.0","0BSD"] |
| 17 | ++ "note": "depends on jsonify which is under Public Domain", |
| 18 | ++ "allow": ["Python-2.0","0BSD", "Public Domain"] |
| 19 | + }, |
| 20 | + "@stoplight/prism-cli":{ |
| 21 | + "note": "dependency [email protected] reports 0BSD which is less restrictive than BSD", |
| 22 | +``` |
| 23 | + |
| 24 | +## Results |
| 25 | + |
| 26 | +```shell |
| 27 | +https://github.com/nodeshift/nodejs-reference-architecture/actions/runs/6474140742 |
| 28 | + |
| 29 | +NPCheck Report |
| 30 | + |
| 31 | +(1): The "cldr-localenames-full" seems that is lacking appropriate testing (https://www.github.com/unicode-cldr/cldr-json) |
| 32 | +(2): The module "cldr-localenames-full" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 33 | +(3): The module "cldr-localenames-full" seems to have no available TypeScript typings. |
| 34 | +(4): The module "eslint" seems to have no available TypeScript typings. |
| 35 | +(5): The module "eslint" has "97" dependencies (including sub-dependencies) which is more than the default "20". |
| 36 | +(6): The latest release of "express" was about 1 year ago |
| 37 | +(7): The module "express" seems to have no available TypeScript typings. |
| 38 | +(8): The module "express" is not tested by community CITGM runs. |
| 39 | +(9): The module "express" has "56" dependencies (including sub-dependencies) which is more than the default "20". |
| 40 | +(10): The latest release of "express-prom-bundle" was 10 months ago |
| 41 | +(11): The latest release of "ibmcloud-appid" was 8 months ago |
| 42 | +(12): The module "ibmcloud-appid" has "220" dependencies (including sub-dependencies) which is more than the default "20". |
| 43 | +(13): The module "i18next" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 44 | +(14): The module "i18next" is not tested by community CITGM runs. |
| 45 | +(15): The latest release of "i18next-icu" was 6 months ago |
| 46 | +(16): The module "i18next-icu" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 47 | +(17): The module "i18next-http-middleware" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 48 | +(18): The module "i18next-fs-backend" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 49 | +(19): The module "ioredis" is not tested by community CITGM runs. |
| 50 | +(20): The module "node-rdkafka" seems to have no available TypeScript typings. |
| 51 | +(21): The module "opossum" seems to have no available TypeScript typings. |
| 52 | +(22): The latest release of "passport" was over 1 year ago |
| 53 | +(23): The module "passport" seems to have no available TypeScript typings. |
| 54 | +(24): The module "pino" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 55 | +(25): The module "pino" has "22" dependencies (including sub-dependencies) which is more than the default "20". |
| 56 | +(26): The latest release of "rhea" was 9 months ago |
| 57 | +(27): The module "rhea" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 58 | +(28): The latest release of "mocha" was 10 months ago |
| 59 | +(29): The module "mocha" seems to have no available TypeScript typings. |
| 60 | +(30): The module "mocha" has "72" dependencies (including sub-dependencies) which is more than the default "20". |
| 61 | +(31): The "jest" seems that is lacking appropriate testing (https://www.github.com/jestjs/jest) |
| 62 | +(32): The module "jest" has "260" dependencies (including sub-dependencies) which is more than the default "20". |
| 63 | +(33): The module "@ibm-cloud/cloudant" has "93" dependencies (including sub-dependencies) which is more than the default "20". |
| 64 | +(34): The latest release of "nano" was 9 months ago |
| 65 | +(35): The module "odbc" has "57" dependencies (including sub-dependencies) which is more than the default "20". |
| 66 | +(36): The module "ibm_db" seems to have no available TypeScript typings. |
| 67 | +(37): The module "ibm_db" has "45" dependencies (including sub-dependencies) which is more than the default "20". |
| 68 | +(38): The module "mongodb" is not tested by community CITGM runs. |
| 69 | +(39): The module "pg" seems to have no available TypeScript typings. |
| 70 | +(40): The module "pg" is not tested by community CITGM runs. |
| 71 | +(41): The latest release of "kafkajs" was 8 months ago |
| 72 | +(42): The "@openapitools/openapi-generator-cli" seems that is lacking appropriate testing (https://www.github.com/OpenAPITools/openapi-generator-cli) |
| 73 | +(43): The module "@openapitools/openapi-generator-cli" seems to have no available TypeScript typings. |
| 74 | +(44): The module "@openapitools/openapi-generator-cli" has "106" dependencies (including sub-dependencies) which is more than the default "20". |
| 75 | +(45): The module "openapi-backend" has "32" dependencies (including sub-dependencies) which is more than the default "20". |
| 76 | +(46): The module "@stoplight/prism-cli" is not tested by community CITGM runs. |
| 77 | +(47): The module "@stoplight/prism-cli" has "179" dependencies (including sub-dependencies) which is more than the default "20". |
| 78 | +(48): The module "express-openapi-validator" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 79 | +(49): The module "express-openapi-validator" has "57" dependencies (including sub-dependencies) which is more than the default "20". |
| 80 | +(50): The module "swagger-editor" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 81 | +(51): The module "swagger-editor" seems to have no available TypeScript typings. |
| 82 | +(52): The module "swagger-editor" has "318" dependencies (including sub-dependencies) which is more than the default "20". |
| 83 | +(53): The latest release of "openapi-editor" was almost 3 years ago |
| 84 | +(54): The module "openapi-editor" has "200" dependencies (including sub-dependencies) which is more than the default "20". |
| 85 | +(55): The latest release of "nyc" was over 3 years ago |
| 86 | +(56): The module "nyc" seems to have no available TypeScript typings. |
| 87 | +(57): The module "nyc" is not tested by community CITGM runs. |
| 88 | +(58): The module "nyc" has "145" dependencies (including sub-dependencies) which is more than the default "20". |
| 89 | +(59): The module "dotenv" is not tested by community CITGM runs. |
| 90 | +(60): The module "node-vault" seems to have no available TypeScript typings. |
| 91 | +(61): The module "node-vault" is not tested by community CITGM runs. |
| 92 | +(62): The module "node-vault" has "59" dependencies (including sub-dependencies) which is more than the default "20". |
| 93 | +(63): The module "@ibm-cloud/secrets-manager" seems to have no available TypeScript typings. |
| 94 | +(64): The module "@ibm-cloud/secrets-manager" is not tested by community CITGM runs. |
| 95 | +(65): The module "@ibm-cloud/secrets-manager" has "93" dependencies (including sub-dependencies) which is more than the default "20". |
| 96 | +(66): The module "@opentelemetry/sdk-trace-base" is not tested by community CITGM runs. |
| 97 | +(67): The module "@opentelemetry/sdk-trace-node" is not tested by community CITGM runs. |
| 98 | +(68): The module "axios" does not specify the engines field or package-support.json, so we cannot determine if it supports the LTS versions of Node.js. |
| 99 | +(69): The module "axios" is not tested by community CITGM runs. |
| 100 | +(70): The module "node-fetch" is not tested by community CITGM runs. |
| 101 | +(71): The latest release of "cors" was almost 5 years ago |
| 102 | +(72): The module "cors" seems to have no available TypeScript typings. |
| 103 | +(73): The module "cors" is not tested by community CITGM runs. |
| 104 | + |
| 105 | +``` |
| 106 | +
|
| 107 | +New (materially) since last review (excluding ones were # deps was already over limit and changed): |
| 108 | +``` |
| 109 | +(8): The module "express" is not tested by community CITGM runs. |
| 110 | +(11): The latest release of "ibmcloud-appid" was 8 months ago |
| 111 | +(15): The latest release of "i18next-icu" was 6 months ago |
| 112 | +(26): The latest release of "rhea" was 9 months ago |
| 113 | +(28): The latest release of "mocha" was 10 months ago |
| 114 | +(34): The latest release of "nano" was 9 months ago |
| 115 | +(41): The latest release of "kafkajs" was 8 months ago |
| 116 | +(53): The latest release of "openapi-editor" was almost 3 years ago |
| 117 | +(55): The latest release of "nyc" was over 3 years ago |
| 118 | +(71): The latest release of "cors" was almost 5 years ago |
| 119 | +``` |
| 120 | +## Notes |
| 121 | +- some modules have been removed from CITGM in a community attempt to get it to |
| 122 | + a green state, hopefully express will make it back in at some point in the next |
| 123 | + quarter |
| 124 | +- none of the last release which is still less than 1 year is a concern |
| 125 | +- the last releases of 'openapit-editor', 'nyc' and 'cors' are worth discussing |
| 126 | + in a future Reference architecture team meeting. |
0 commit comments