Project 3A: Static Test - Retire.js

[newmoooon]

Concrete evidence that you have successfully installed the tool

• I used "npm install --save-dev retire" to install
• In package.json and package-lock.json, we can see that retire was installed

Artifacts that demonstrate that you have successfully run the tool on your repository

• I used "npx retire --outputformat text --outputpath retire-results.txt" to run the test and save the results in retire-results.txt

Pros

• Easy accessible because it is open-source and can be easily installed on the terminal, so anyone should be able to use it
• It is great with detecting outdated or vulnerable JavaScript libraries, which is hard to notice by a human
• There are multiple usage formats such as CLI, extension, etc.
• It creates a report
• It gives specific feedback on where and why something is broken and some ideas of fixing it

Cons

• There are possibilities for false positives such as flagging files that are not loaded in production environment
• It only detects known vulnerabilities that is in its database so it has limited scope
• It is a static tool so if a new vulnerability is discovered a bit later, the report is already outdated
• You may use a library with an issue, but your code doesn't trigger that issue. But retire.js is not able to tell that, because it is a static test.

[newmoooon]

Wrong PR repo sorry