Forum Discussion
Visual Object - node modules vulnerabilities
Hi,
I cloned a certified visual object code to add some modifications. In the github repo there are no vulnerabilities reported but when I install (through npm i) the necessary packages "npm audit" command finds some vulnerabilities.
I read https://github.com/microsoft/PowerBI-visuals-tools/issues/383 that the right command to check vulnerabilities on visual is "npm audit --production", beacause it does not consider devDependencies.
So I have 2 questions:
2 Replies
Hi jay-jay ,
1.
There are some requirements and tests before a Power BI visual certified.
You may refer to the blogs as below.
For reference:
Test a Power BI visual before submitting it
2.
This PR enables using the existing
--productionflag when runningnpm audit. Using this flag will ignore dev dependencies when assigning therequiresconstant that is passed toaudit.generate.For reference: Enable production flag for npm audit
Best Regards,
Rico ZhouIf this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
I read the documentation about certification requirements and one requirement is "the visual must not have vulnerabilities", but it is not guaranteed the visual will not have some in the future.
I cloned the chicletSlicer code from github. The visual is developed with an old version of powerbi-visuals-tools: "npm i" finds some vulnerabilities, on the contrary "npm i --production" doesn't find anything (all packages are in devDependencies). So can I suppose there are not vulnerabilities when I build the component through "pbiviz package" or do I have to set some configuration files?
