Operational issues with umzug module

[Pavan1925]

Team,

I wanted to point out that Black Duck is flagging operational vulnerabilities with umzug due to a lack of active development. Please update the dependency packages to the latest versions.

Any updates or plans for future development would be greatly appreciated.

Please take a look below report from blackduck and upgrade dependency modules accordingly.

Black Duck.pdf

[mmkal]

Please share which dependencies you think are a problem directly on the issue as text or a screenshot. There have been some issue spam/phishing attempts recently I've seen.

Umzug is actively developed.

[Pavan1925]

Hi @mmkal ,
Below are the screenshots as well as some of the operational issue factors:

These are some of issue but not all dependency packages with issues:

[WikiRik]

This seems to be a bug on their end, the last release date is correct but commits have been merged in the last 12 months.

Also; this is a bigger issue in the sector. Sometimes projects are feature complete and do not require regular releases. Therefore the risk is a false positive. Packages that do not have releases often might be more stable then packages that do

[WikiRik]

That being said; we can do a check on the current dependencies that we use and see if we can update to the latest version

[mmkal]

I will take a look, but some of these might be coming from ts-command-line.

Recently I've been developing trpc-cli which I think would be a good fit. It does have dependencies but no transitive ones. I agree that this report looks inaccurate but I am in favour of moving off ts-command-line anyway.

[HoldYourWaffle]

I'd love to see a move away from ts-command-line!
According to npm.anvaka.com it's responsible for 34 out of umzug's 55 transitive dependencies.
The less we have to worry about the risk of supply chain attacks the better as far as I'm concerned :)

Anything I can do to help in this area?

[mmkal]

I've only been able to find short bursts to work on this - but you could test out the pkg-pr-new package here: #703