topic Re: Visual Object - node modules vulnerabilities in Developer

Visual Object - node modules vulnerabilities

jay-jay — Fri, 25 Feb 2022 13:43:13 GMT

Hi,

I cloned a certified visual object code to add some modifications. In the github repo there are no vulnerabilities reported but when I install (through npm i) the necessary packages "npm audit" command finds some vulnerabilities.

I read https://github.com/microsoft/PowerBI-visuals-tools/issues/383 that the right command to check vulnerabilities on visual is "npm audit --production", beacause it does not consider devDependencies.

So I have 2 questions:

- Is the certified visual object continuously checked?

- Can I use the object without security issues?

Thanks,

Re: Visual Object - node modules vulnerabilities

Anonymous — Mon, 28 Feb 2022 08:06:55 GMT

Hi @jay-jay ,

There are some requirements and tests before a Power BI visual certified.

You may refer to the blogs as below.

For reference:

Test a Power BI visual before submitting it

Certification requirements

This PR enables using the existing --production flag when running npm audit. Using this flag will ignore dev dependencies when assigning the requires constant that is passed to audit.generate.

For reference: Enable production flag for npm audit

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Re: Visual Object - node modules vulnerabilities

jay-jay — Tue, 01 Mar 2022 12:49:36 GMT

I read the documentation about certification requirements and one requirement is "the visual must not have vulnerabilities", but it is not guaranteed the visual will not have some in the future.

I cloned the chicletSlicer code from github. The visual is developed with an old version of powerbi-visuals-tools: "npm i" finds some vulnerabilities, on the contrary "npm i --production" doesn't find anything (all packages are in devDependencies). So can I suppose there are not vulnerabilities when I build the component through "pbiviz package" or do I have to set some configuration files?