Detected vulnerable npm dependencies

[sonodew]

Describe the bug
Current tensormap client project is not having the latest npm modules. This enforces a threat on security side as there are vulnerable npm packages as dependencies.

To Reproduce
Steps to reproduce the behavior:

Navigate to client project and run 'npm audit'

Expected behavior
Should list number of vulnerabilities along with the vulnerable packages.

Screenshots

Following are the identified vulnerable packages.
@adobe/css-tools <=4.3.1
Severity: moderate

@babel/traverse <7.23.2
Severity: critical

axios 0.8.1 - 0.27.2
Severity: moderate

follow-redirects <1.15.4
Severity: moderate

nth-check <2.0.1
Severity: high

postcss <8.4.31
Severity: moderate

semver 6.0.0 - 6.3.0 || 7.0.0 - 7.5.1
Severity: moderate

tough-cookie <4.1.3
Severity: moderate

word-wrap <1.2.4
Severity: moderate

Desktop (please complete the following information):

• OS: Linux
• Browser: Chrome

[sonodew]

I am working on a fix for this issue.

[Teak-Rosewood]

@sonodew hey, figured the main issue was react-scripts, so I have moved to Vite, there are no dependency issues anymore, look into my PR!

[sonodew]

Hi @Teak-Rosewood, there is no issue with react-script. We can move that into dev dependencies and check the audit logs. react-scripts does have a false alarm on certain npm packages:ref -> git stackoverflow.

On the other hand, moving from react-script to vite needs full test suit on UI side to verify the UI will be rendered without any issue. Current code base does not have such test suit and I believe in that case using vite is not the right solution.

[Teak-Rosewood]

@sonodew create-react-app has since been deprecated, and considering the tests that have been currently made are quite basic, and a few dont work, I think it would be ideal to switch to vite or next, i am currently in the process of writing tests in vite, will be pushing some soon!

[sonodew]

@Teak-Rosewood agree. In that case the PR should come along with those test cases since introducing vite or nextjs (if we do not rely on SSR we should go with vite) is a feature and not a solution for a existing issue in my opinion.