NPM 11 high severity vulnerabilities

[bramp]

Steps to reproduce the issue, if applicable. Include the actual command and output and/or stack trace.

$ npm install

npm WARN deprecated minimatch@2.0.10: Please update to minimatch 3.0.2 or higher to avoid a RegExp DoS issue
npm WARN deprecated jscs-preset-wikimedia@1.0.1: No longer maintained. We recomment migrating to ESLint with eslint-config-wikimedia.
npm WARN deprecated common-style@3.1.0: common-style is now eslint-config-populist. Consider upgrading!
npm WARN deprecated nomnom@1.8.1: Package no longer supported. Contact support@npmjs.com for more info.
npm WARN deprecated core-js@1.2.7: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

11 high severity vulnerabilities

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

What did you expect to happen?

No severity vulnerabilities

If the issue is a feature request, what is the motivation / use case for it?

N/A

Tell us about your environment

• exact http-server version:
• Node version:
• Platform:

Other information (related issues, suggestions for a fix, etc):

I'm going to fix it :)

[bramp]

I replaced common-style with populist-style, and sent a PR to the upstream populist-style project, and if that's accepted, the situation improves greatly to:

6 low severity vulnerabilities

[bramp]

I'm landing my changes into https://github.com/bramp/http-server/tree/issue676 until I'm ready to send a pull request.

[thornjad]

For populist-style, you're probably unlikely to hear anything on that PR. I'm thinking we should move http-server to ESLint instead.

As for the vulnerabilities, npm audit reports 12 on master right now. All of them claim to be fixable with npm audit fix, but that command seems to do absolutely nothing for me for some reason.

[thornjad]

Looking closer, all of these vulnerabilities are in dev dependencies, so there's no actual threat (see: npm audit: Broken by Design). I'll still welcome PRs that decrease these warnings, but since there's no prod concern, I'm closing this.