This product is meant for educational purposes only.  Any resemblance to real persons, living or dead is purely coincidental.  Void where prohibited.  Some assembly may be required.  Batteries not included.  Contents may settle during shipment.  Use only as directed.  May be too intense for some viewers.  If condition persists, consult your physician.  No user-serviceable parts inside. Breaking seal constitutes acceptance of agreement.  Not responsible for direct, indirect, incidental or consequential damages resulting from any defect, error or failure to perform.  Slippery when wet.  For office use only.  Substantial penalty for early withdrawal.  Do not write below this line.  Your cancelled check is your receipt.  Avoid contact with skin.  Employees and their families are not eligible.  Beware of dog.  Driver does not carry cash.  Limited timeoffer, call now to insure prompt delivery.  Use only in well-ventilated area. Keep away from fire or flame.  Some equipment shown is optional.  Price does not include taxes, dealer prep, or delivery.  Penalty for private use.  Call toll free before digging.  Some of the trademarks mentioned in this product appear for identification purposes only.  All models over 18 years of age.  Do not use while operating a motor vehicle or heavy equipment.  Postage will be paid by addressee.  Apply only to affected area.  One size fits all.  Many suitcases look alike.  Edited for television.  No solicitors.  Reproduction strictly prohibited.  Restaurant package, not for resale.  Objects in mirror are closer than they appear.  Decision of judges is final.  This supersedes all previous notices.  No other warranty expressed or implied.

Edit: This morning I managed to get it all down to only 1 fixable vulnerability by setting:

? Set up unit tests: No
? Setup e2e tests with Nightwatch? No

Still, I think I’ll keep this on the dev-box until I’m reasonably certain I can control this beast.

Why not check out vuejs I thought… I’m new to all this server side JavaScript. But it sounds like fun, so lets see…

Hmmm… I just did an npm install fresh outta the box after installing some Vue.js prefabricated stuff ($ vue init webpack project_name) and my cmd spit out this:

added 1513 packages from 1798 contributors and audited 12011 packages in 33.859s. found 21 vulnerabilities (11 low, 1 moderate, 7 high, 2 critical) run "npm audit fix" to fix them, or "npm audit" for details

Neat!! 1513 packages! Wow. Thats a huge amount of Open Source spagetti. We are legion! We are NPM!!

These smart guys in the JS community, they have a command to fix vulnerabilities!

I don’t know how that would work, but I commend you brave anonymous programmer!

Wait… 2 Critical out-of-the-box security vulnerabilities? Ok, so npm audit fix it is… Now what?

fixed 0 of 21 vulnerabilities in 12011 scanned packages 4 package updates for 21 vulns involved breaking changes (use "npm audit fix --force" to install breaking changes; or do it by hand)

Umm, ok… npm audit then.

# Run npm install --save-dev nightwatch@1.0.6 to resolve 6 vulnerabilities SEMVER WARNING: Recommended action is a potentially breaking change

Meh. Breaking sheaking… lets do this!

npm install --save-dev karma@2.0.4

Six down, and only 15 vulnerabilities left…

npm install --save-dev url-loader@1.0.1

14… At this point the --force option is starting to look tempting. No. Can’t let the machine win on the dev box, this is my turf dammit!

I head over to the docs and see:

To address the vulnerability, you can

• Check for mitigating factors
• Update dependent packages if a fix exists
• Fix the vulnerability
• Open an issue in the package or dependent package issue tracker

Ok… lets try the first one. What does this say:

Affected versions of growl do not properly sanitize input prior to passing it into a shell command, allowing for arbitrary command execution.

What? arbitrary command execution?? No, no, fuck that. Jesus… I tried updating the package to the latest version. No fix.

So fix it myself? On my first day on the job?.. What the heck, lets see. The node page says …

1,217,161 downloads this week. Nope. I’m not up to that amount of crazy. Normal crazy maybe. But this is one million two hundred thousand crazies. Nope, nope. No.

Right. Maybe I try Rust next time. I hear the rust-todoMVC is lovely this time of the year.