Update uglify-js

[AlexanderMoskovkin]

to fix vulnerabilities: https://nodesecurity.io/check/testcafe-legacy-api

[Zarel]

GitHub is now complaining about this in every project that uses testcafe at all...

https://github.com/blog/2470-introducing-security-alerts-on-github

(I'm not sure why testcafe requires testcafe-legacy-api in the first place)

[AlexanderMoskovkin]

Hi @Zarel,

Thanks for pointing this out. We'll force our work on this issue.

[AlexanderMoskovkin]

I'm working on this

[AlexanderMoskovkin]

I've investigated it. Now we use [email protected]. To fix vulnerabilities we need to update to >=2.6.0. To migrate from 1.x.x to 2.x.x we should rewrite our legacy api compilator. Uglify JS was completely reworked after 1.x.x. Another API, another internal structure of ast. So it can take some additional time to update this.

The testcafe-legacy-api module is used by testcafe when you run tests written by using the legacy api syntax which was implemented for the previous paid TestCafe version. So the problem is not actual if you run tests written by using the new API.

[Zarel]

I mean, that's all fair, but npm doesn't actually support not installing unnecessary dependencies (they basically don't seem to care about optional dependencies at all; see npm/npm#17633), so [email protected] is still installed by default when someone types npm install testcafe, so GitHub will still issue security warnings to every repository that has testcafe in its package.json dependencies.

In summary: If someone types npm install testcafe in a GitHub repo, GitHub will give them a security warning. It's up to you what you want to do about that, but just be aware that that's the case.

[AlexanderMoskovkin]

Now testcafe-legacy-api doesn't have uglify-js in the package.json.
After some investigation I've found the following things. It's marked that [email protected] has two vulnerabilities.

In fact one of them (https://nodesecurity.io/advisories/39) is actual only for 2.0.0 - 2.4.23 versions. It works properly with the 1.x.x.
The other (https://nodesecurity.io/advisories/48) is actual for 1.x.x.

I've copied required uglify-js scripts to our repository, fixed the vulnerability error and added tests for this.

[Zarel]

Oh, I see! Yeah, that's a good solution.