Building Hylia locally

#1

Hello everyone, I am having a bit of a rough day and my internet is out so I decided to play around with 11ty and Hylia locally on my machine. I installed 11ty and so far so awesome. It is way faster and easier than Jekyll.

Anyway, I forked hylia on github and then went to work in terminal. However github gave me a security alert which states:

#### Remediation

Upgrade minimist to version 1.2.3 or later. For example:

"dependencies": { "minimist": ">=1.2.3" }

or…

"devDependencies": { "minimist": ">=1.2.3" }

Always verify the validity and compatibility of sug

and in terminal I get:

added 954 packages from 612 contributors and audited 9343 packages in 30.734s

5 packages are looking for funding
  run `npm fund` for details

found 9 low severity vulnerabilities
  run `npm audit fix` to fix them, or `npm audit` for details

Here is the audit output

=== npm audit security report ===                        
                                                                                
# Run  npm update mkdirp --depth 6  to resolve 1 vulnerability
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @11ty/eleventy                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @11ty/eleventy > browser-sync > chokidar > fsevents >        │
│               │ node-pre-gyp > mkdirp > minimist                             │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


# Run  npm update chokidar --depth 3  to resolve 4 vulnerabilities
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ sass                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ sass > chokidar > fsevents > node-pre-gyp > mkdirp >         │
│               │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ 9fd84650d1e1f7c1ff0f5d7fa3a09774dee940a5a0ccafea6a3581391db… │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ 9fd84650d1e1f7c1ff0f5d7fa3a09774dee940a5a0ccafea6a3581391db… │
│               │ > sass > chokidar > fsevents > node-pre-gyp > mkdirp >       │
│               │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ sass                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ sass > chokidar > fsevents > node-pre-gyp > tar > mkdirp >   │
│               │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ 9fd84650d1e1f7c1ff0f5d7fa3a09774dee940a5a0ccafea6a3581391db… │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ 9fd84650d1e1f7c1ff0f5d7fa3a09774dee940a5a0ccafea6a3581391db… │
│               │ > sass > chokidar > fsevents > node-pre-gyp > tar > mkdirp > │
│               │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


# Run  npm update tar --depth 6  to resolve 1 vulnerability
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @11ty/eleventy                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @11ty/eleventy > browser-sync > chokidar > fsevents >        │
│               │ node-pre-gyp > tar > mkdirp > minimist                       │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


# Run  npm update minimist --depth 7  to resolve 3 vulnerabilities
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @11ty/eleventy                                               │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ @11ty/eleventy > browser-sync > chokidar > fsevents >        │
│               │ node-pre-gyp > rc > minimist                                 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ sass                                                         │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ sass > chokidar > fsevents > node-pre-gyp > rc > minimist    │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low           │ Prototype Pollution                                          │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package       │ minimist                                                     │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ 9fd84650d1e1f7c1ff0f5d7fa3a09774dee940a5a0ccafea6a3581391db… │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path          │ 9fd84650d1e1f7c1ff0f5d7fa3a09774dee940a5a0ccafea6a3581391db… │
│               │ > sass > chokidar > fsevents > node-pre-gyp > rc > minimist  │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info     │ https://npmjs.com/advisories/1179                            │
└───────────────┴──────────────────────────────────────────────────────────────┘


found 9 low severity vulnerabilities in 9343 scanned packages
  run `npm audit fix` to fix 9 of them.

is this the sort of thing that I can:

  1. Ignore
  2. Run npm audit fix and be good to go?
    I don’t want to break the theme but I also want to be mindful of security.

Thanks y’all.

2 Likes
#2

Your npm audit reports 9 times :
Low │ Prototype Pollution
Package │ minimist
More info │ https://npmjs.com/advisories/1179

Solution is to update the package minimist (as listed after “More info” in the audit log) : https://www.npmjs.com/advisories/1179

This is what I would do (when internet becomes available):
If your project’s directory name is MyProject, rename it to MyProject-original for example.
Then deep copy the MyProject-original directory to a new directory MyProject.
Change directory into the newly created MyProject.
Use npm audit fix, or upgrade the minimist package with npm update.

  • npm outdated : To see which modules have newer versions
  • Watch out for major version upgrades, these usually break stuff.
  • Add --save-dev|--dev to the npm update command below to save the newer version number(s) to package.json.
  • npm update minimist : (with package name) to update just minimist.
    or
  • npm update : (without a package name) to update all modules
  • Then check if all is fixed and still working. If not, delete the MyProject directory and rename MyProject-original back to MyProject.
#3

Thanks so much. I just got the FiOS back and I feel cyborg again. I will try this out. I really appreciate it.

#4

It worked great and I got minimist upgraded with no problem. Thank you

1 Like
#5

Good to hear you’re sorted now. Keep going.

#6

Yeh I totally need to run some updates on packages. Thanks for this, folks :slightly_smiling_face:

1 Like