Outdated axios dependencies

Doing a fresh install of Appium makes npm audit throw a tantrum: found 153 vulnerabilities (2 low, 151 high)

All of the found vulnerabilities seems to be caused by old versions of Axios.

I haven’t looked into whether or not these vulnerabilities actually affect Appium, but either way it would be nice to not have npm nagging you.

Environment

• Appium version (or git revision) that exhibits the issue: 1.20.2
• Desktop OS/version used to run Appium: macOS 11.2.1
• Node.js version (unless using Appium.app|exe): v14.15.5
• Npm or Yarn package manager: Npm 6.14.11
• Appium CLI or Appium.app|exe: CLI

Code To Reproduce Issue [ Good To Have ]

npm init -y npm i appium

[Simon-TechForm]

These two packages are third-party dependencies, which we cannot influence much, their authors decide it on their own when to publish new versions.

Regarding the npm behaviour: it could be it is using a shrinkwrap file, where versions of particular modules are locked, so it does not try to get updated versions of them. This should not be the case for appium@beta though, which is not shrinkwrapped

Yeah, I noticed that. We’ll just have to wait.

Ah, there’s a shrinkwrap file in appium. I did not notice that. Thank you.

Should we keep this issue open for other npm users to see? Maybe until the huge amount of vulnerabilities are removed from the package?

If not, feel free to close this.

[mykola-mokhnach]

These two packages are third-party dependencies, which we cannot influence much. The authors decide it on their own when to publish new versions.

Regarding the npm behaviour: it could be it is using a shrinkwrap file, where versions of particular modules are locked, so it does not try to get updated versions of them. This should not be the case for appium@beta though, which is not shrinkwrapped