[mandyparson]

Overview

What is the feature?

Resolve the snyk vulnerabilities on the project https://app.snyk.io/org/esdis-cumulus-core-gibs-cmr-etc./project/a8adc8b1-d7ce-40ee-b43d-c7944df23e3a

What is the Solution?

Upgrade electron-updater@6.6.2 to electron-updater@6.8.9 to fix
✗ Insertion of Sensitive Information Into Sent Data (new) [High Severity]

After that we were still sitting at 32 vulnerabilities (1 low, 19 moderate, 9 high, 3 critical) ran npm audit fix got it down to 20 vulnerabilities (17 moderate, 1 high, 2 critical)

I ran a depcheck and discovered several unused dependencies that were causing some of the issues above. I uninstalled the ones that I doubled checked were not being used anywhere in the repo: npm uninstall undici nyc jest-junit

nyc is a code coverage tool that it appears we used at one point. Jest covers all the use cases nyc was for so I deleted the old files that weren't being used as well.

After making those changes we are now at 16 vulnerabilities (14 moderate, 2 critical). There are no fixes available for the critical vulnerabilities at this time.

What areas of the application does this impact?

package.json and associated nyc files

Testing

Reproduction steps

• Environment for testing:
• Collection to test with:

1. Sanity check to make sure these changes didn't break anything on the app
2. npm run test to ensure all tests pass after removing nyc

Attachments

Please include relevant screenshots or files that would be helpful in reviewing and verifying this change.

Checklist

• I have added automated tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have bumped the version field in package.json and ran npm install

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.64%. Comparing base (9255e3d) to head (dc6b9e6).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #79   +/-   ##
=======================================
  Coverage   95.64%   95.64%           
=======================================
  Files         121      121           
  Lines        2504     2504           
  Branches      495      496    +1     
=======================================
  Hits         2395     2395           
  Misses        109      109           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[macrouch]

electron-updater is used in the application to check for updates to the app. this update should trigger a new app version so the running code is updated