NPM vulnerabilities

[zen4569]

After using npm audit fix --force on openhamclock running on my raspberry pi 4,
I am still seeing 23 vulnerabilities with 4 moderate and 19 high severity issues in the NPM packages used by openhamclock. Can this be addressed by the developers?

[accius]

Thanks for flagging this! A few important things to understand about those npm audit results:

First — please don't run npm audit fix --force on OpenHamClock. That command force-upgrades packages to major versions that can (and will) break things. It's a sledgehammer, not a scalpel.

Second — the vast majority of those 23 vulnerabilities are in dev dependencies (Electron, Vite, testing tools) that are NOT included when you run OpenHamClock. They only exist in the development toolchain used to build the app. They don't ship in your running server and cannot be exploited on your Pi.

For the production dependencies, here's the actual picture:

• express v4 — has some known advisories, but we use helmet, rate limiting, CORS, and input validation on top of it. Express v5 is still very new and we'll evaluate it when the ecosystem catches up.
• node-fetch v2 — flagged because v3 exists, but v3 is ESM-only which would require rewriting the entire server. The actual CVEs don't apply to our usage.
• axios — transitive dependency advisories, typically around prototype pollution that doesn't apply in our context.

npm audit is a useful tool, but it's notorious for false positives and conflating dev/production risk. A vulnerability in your test runner is not the same as a vulnerability in your web server.

That said, we do take this seriously and will be reviewing and updating dependencies as part of our regular Tuesday release cycle. If you want the safest setup, just run OpenHamClock as-is from a clean npm install without the --force flag.

73 de K0CJH

[denete]

@accius I would like to ask that we consider the following options.

1. Locking versions in package.json to help ensure that we don't break features that aren't being specifically tested.
2. Using .nvmrc to ensure that we are using the same version of Node