Skip to content

Conversation

@radu-matei
Copy link
Member

npm audit --prod       
npm warn config production Use `--omit=dev` instead.
found 0 vulnerabilities

The remaining vulnerability is because of broken-link-checker, and is a dev dependency:

npm audit                    
# npm audit report

tough-cookie  <4.1.3
Severity: moderate
tough-cookie Prototype Pollution vulnerability - https://github.com/advisories/GHSA-72xf-g2v4-qvf3
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/tough-cookie
  bhttp  *
  Depends on vulnerable versions of tough-cookie
  node_modules/bhttp
    broken-link-checker  >=0.5.0
    Depends on vulnerable versions of bhttp
    node_modules/broken-link-checker

3 moderate severity vulnerabilities

@flynnduism -- do we actually run the broken link checker in CI?
I couldn't find a suitable upgrade to get rid of the vulnerability, so not sure if we can without replacing the dependency altogether.

@radu-matei radu-matei requested a review from flynnduism November 5, 2025 10:36
@github-actions
Copy link

github-actions bot commented Nov 5, 2025

🚀 preview deployed successfully to Fermyon Cloud and available at https://spin-docs-pr-144-6csdmmns.fermyon.app

@karthik2804
Copy link
Contributor

@radu-matei We run broken-link-checker as part of the build action to test for broken links.

@radu-matei
Copy link
Member Author

This change does not remove it. But it is at this point the only unmaintained dependency and the source for the remaining vulnerabilities AFAICT.
It is a dev dependency, so we're not shipping that in prod; and this runs in the Wasm sandbox anyway, but I would like to address it anyway eventually.

This PR improves the status quo.

@itowlson itowlson merged commit 6edbea5 into main Nov 5, 2025
3 checks passed
@itowlson
Copy link
Contributor

itowlson commented Nov 5, 2025

@karthik2804 Is this the "better broken link checker" that you wrote, or have we not ported that one here?

@karthik2804
Copy link
Contributor

@itowlson I believe this is the older one and we have not updated it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants