greenkeeper pr's failing

[seriousme]

Hi,

I noticed that there are 10 PR's created by greenkeeper waiting for merge.
I looked at some of them and they seem to show red because Travis had no access to the most recent version of the dependency at the time of PR creation. I had the same issue in some of my repo's some time ago and just asking Travis to rebuild solved the issue for me.

The reason for creating the issue is that NPM audit keeps complaining about vulnerable dependencies of pouchdb-server :-(

Most notably:

  High            Regular Expression Denial of Service
  Package         sshpk
  Dependency of   pouchdb-server
  Path            pouchdb-server > pouchdb-adapter-node-websql > websql >
                  sqlite3 > node-pre-gyp > request > http-signature > sshpk
  More info       https://nodesecurity.io/advisories/606

Fixed by: #313

  High            Regular Expression Denial of Service
  Package         fresh
  Patched in      >= 0.5.2
  Dependency of   pouchdb-server
  Path            pouchdb-server > serve-favicon > fresh
  More info       https://nodesecurity.io/advisories/526

Fixed by: #315

Fixing these would be much appreciated.

Kind regards,
Hans

[marten-de-vries]

Thanks for your bug report.

Just rebuilding is not enough, sadly. See e.g. https://travis-ci.org/pouchdb/pouchdb-server/jobs/342637398 which I just triggered manually. I don't have time to look further into the issue myself, but if anyone has time to do so feel free to @mention me in resulting PRs so I can help with getting things merged.

[seriousme]

I checked the build log you mentioned and its reason for failing is the problem with greenkeeper updating the package.json, but not the package-lock.json

The quickfix is to checkout the greenkeeper branch, run npm i and commit the package-lock.json

However this problem will repeat itself on the next greenkeeper branch :-(
The solution is described at: https://github.com/greenkeeperio/greenkeeper-lockfile

This will ensure that as soon as greenkeeper creates a new branch and travis-ci runs the CI the package-lock.json will be pushed back to the branch. Unfortunately this does not fix any existing greenkeeper branches :-(

[marten-de-vries]

Ok, that seems to fix the build for the sqlite3 branch. Others fail on npm install because of some sqlite error, so I guess merging the sqlite3 branch should be the first focus. If it passes Travis, I'll do so tomorrow.

[marten-de-vries]

Ok, two PRs left open. memdown and nomnom. Both are special cases: the first changed API in such a way that it broke the tests, the second is no longer developed.

I looked into greenkeeper-lockfile, but there's a couple of problems

• a GH_TOKEN is essentially a master key to my Github account, sharing it with everyone in the pouchdb org for this is a bit much.
• apparently, there is an open npm ci bug: How to make this work with npm ci? greenkeeperio/greenkeeper-lockfile#156

Probably all fixable, but currently too much work for me. Leaving this open in the hope someone will figure this out. Also so a release can happen at some point again, incorporating the updates.

[seriousme]

Thanks for putting in the effort !

With regards to the two remaining items:

• Memdown has a special page on upgrading:
  https://github.com/Level/memdown/blob/HEAD/UPGRADING.md
  as LevelUp has changed its interface when moving to V2

• Nomnom has a fork which is still supported:
  https://www.npmjs.com/package/@gerhobbelt/nomnom
  Question is if you'd want to continue nomnom or change to e.g. commander

A new release (even without the above 2 items) would be appreciated as this will resolve my initial question ;-)

[marten-de-vries]

Alright. Pouchdb itself still seems to use the old memdown, so I'm going to follow it in that. Nice find on the nomnom fork, I'm running CI on that now. If it passes, I'll merge it. I'll make a release next.

[marten-de-vries]

https://github.com/pouchdb/pouchdb-server/releases/tag/4.0.1