fix: removing low severity warning in npm audit

.gitea/workflows/build.yaml

@@ -44,7 +44,7 @@ jobs:
           cd ./sas
           npm audit --omit=dev
           cd ../client
-          npm audit --audit-level=low --omit=dev
+          npm audit --omit=dev
 
       - name: Lint check
         run: npm run lint:check

.gitea/workflows/release.yaml

@@ -51,7 +51,7 @@ jobs:
           cd ./sas
           npm audit --omit=dev
           cd ../client
-          npm audit --audit-level=low --omit=dev
+          npm audit --omit=dev
 
       - name: Angular Tests
         run: |

client/package.json

@@ -61,8 +61,10 @@
     "@types/d3-graphviz": "^2.6.7",
     "@types/text-encoding": "0.0.35",
     "base64-arraybuffer": "^0.2.0",
+    "browserify-cipher": "^1.0.1",
     "buffer": "^5.4.3",
-    "crypto-browserify": "^3.12.1",
+    "create-hash": "^1.2.0",
+    "create-hmac": "^1.1.7",
     "crypto-js": "^4.2.0",
     "d3-graphviz": "^5.0.2",
     "exceljs": "^4.4.0",
@@ -78,6 +80,7 @@
     "ngx-clipboard": "^16.0.0",
     "ngx-json-viewer": "file:libraries/ngx-json-viewer-3.2.1.tgz",
     "os-browserify": "0.3.0",
+    "randombytes": "^2.1.0",
     "rxjs": "^7.8.0",
     "save-svg-as-png": "^1.4.17",
     "stream-browserify": "3.0.0",
@@ -103,12 +106,15 @@
     "@cypress/webpack-preprocessor": "^5.17.1",
     "@lhci/cli": "^0.15.1",
     "@types/core-js": "^2.5.5",
+    "@types/create-hash": "^1.2.6",
+    "@types/create-hmac": "^1.1.3",
     "@types/crypto-js": "^4.2.1",
     "@types/es6-shim": "^0.31.39",
     "@types/jasmine": "~5.1.4",
     "@types/lodash-es": "^4.17.3",
     "@types/marked": "^4.3.0",
     "@types/node": "12.20.50",
+    "@types/randombytes": "^2.0.3",
     "@typescript-eslint/eslint-plugin": "8.65.0",
     "@typescript-eslint/parser": "8.65.0",
     "core-js": "^2.5.4",
@@ -143,4 +149,4 @@
     "uuid": "11.1.1",
     "lighthouse": "13.4.0"
   }
-}
+}

client/src/browserify-cipher.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Type declarations for the untyped `browserify-cipher` package.
+ * Only the cipher functions used by `src/crypto-shim.ts` are declared.
+ */
+declare module 'browserify-cipher' {
+  export interface Cipheriv {
+    update(data: unknown): unknown
+    final(): unknown
+    setAutoPadding(autoPadding?: boolean): void
+  }
+
+  export function createCipheriv(
+    algorithm: string,
+    key: unknown,
+    iv: unknown
+  ): Cipheriv
+
+  export function createDecipheriv(
+    algorithm: string,
+    key: unknown,
+    iv: unknown
+  ): Cipheriv
+}

client/src/crypto-shim.ts

@@ -0,0 +1,30 @@
+/**
+ * Minimal browser shim for the node `crypto` module.
+ *
+ * Replaces `crypto-browserify`, which pulls in `elliptic` (via
+ * `browserify-sign` and `create-ecdh`) - a package with open low-severity
+ * advisories and no fixed release.  None of the signing/ECDH functionality
+ * is needed here: `@sheet/crypto` (see tsconfig `paths` mapping for
+ * "crypto") only uses hashing, HMAC, AES ciphers and random bytes.
+ */
+import createHash from 'create-hash'
+import createHmac from 'create-hmac'
+import { createCipheriv, createDecipheriv } from 'browserify-cipher'
+import randomBytes from 'randombytes'
+
+const HASHES = [
+  'md4',
+  'md5',
+  'ripemd160',
+  'sha1',
+  'sha224',
+  'sha256',
+  'sha384',
+  'sha512'
+]
+
+export function getHashes(): string[] {
+  return [...HASHES]
+}
+
+export { createHash, createHmac, createCipheriv, createDecipheriv, randomBytes }

client/tsconfig.app.json

@@ -10,6 +10,6 @@
     "outDir": "./app",
     "types": []
   },
-  "files": ["src/polyfills.ts", "src/main.ts", "src/app/app.d.ts"],
+  "files": ["src/polyfills.ts", "src/main.ts", "src/app/app.d.ts", "src/crypto-shim.ts"],
   "include": ["src/**/*.d.ts"]
 }

client/tsconfig.json

@@ -17,7 +17,7 @@
     "resolveJsonModule": true,
     "target": "ES2022",
     "paths": {
-      "crypto": ["./node_modules/crypto-browserify"],
+      "crypto": ["./src/crypto-shim"],
       "stream": ["./node_modules/stream-browserify"],
       "assert": ["./node_modules/assert"],
       "http": ["./node_modules/stream-http"],