npcheck.json

{
  "modules": [
    {
      "name": "node-rdkafka",
      "npmlink": "https://www.npmjs.com/package/node-rdkafka",
      "reviewlevel": "Active Watch",
      "activitycurrent": "None",
      "activitytarget": "Tested and Verified",
      "section": [
        "Message Queuing"
      ]
    },
    {
      "name": "cldr-localenames-full",
      "npmLink": "https://npmjs.com/package/cldr-localenames-full",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Internationalization"
      ]
    },
    {
      "name": "eslint",
      "npmlink": "https://www.npmjs.com/package/eslint",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "foundation": "https://openjsf.org/",
      "section": [
        "Code Consistency"
      ]
    },
    {
      "name": "express",
      "npmlink": "https://www.npmjs.com/package/express",
      "reviewlevel": "Active Watch",
      "activitycurrent": "Tested and Verified",
      "activitytarget": "None",
      "foundation": "https://openjsf.org/",
      "section": [
        "Web Framework"
      ]
    },
    {
      "name": "express-prom-bundle",
      "npmlink": "https://www.npmjs.com/package/express-prom-bundle",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Metrics"
      ]
    },
    {
      "name": "helmet",
      "npmlink": "https://www.npmjs.com/package/helmet",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Web Framework",
        "Secure Development Process"
      ]
    },
    {
      "name": "ibmcloud-appid",
      "npmlink": "https://www.npmjs.com/package/ibmcloud-appid",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Authentication"
      ]
    },
    {
      "name": "i18next",
      "npmlink": "https://www.npmjs.com/package/i18next",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Internationalization"
      ]
    },
    {
      "name": "i18next-icu",
      "npmlink": "https://www.npmjs.com/package/i18next-icu",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Internationalization"
      ]
    },
    {
      "name": "i18next-http-middleware",
      "npmlink": "https://www.npmjs.com/package/i18next-http-middleware",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Internationalization"
      ]
    },
    {
      "name": "i18next-fs-backend",
      "npmlink": "https://www.npmjs.com/package/i18next-fs-backend",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Internationalization"
      ]
    },
    {
      "name": "ioredis",
      "npmlink": "https://www.npmjs.com/package/ioredis",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Data Caching",
        "Databases",
        "Message Queuing"
      ]
    },
    {
      "name": "opossum",
      "npmlink": "https://www.npmjs.com/package/opossum",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "Maintainer",
      "activitytarget": "Maintainer",
      "section": [
        "Fault Tolerance"
      ]
    },
    {
      "name": "passport",
      "npmlink": "https://www.npmjs.com/package/passport",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Authentication"
      ]
    },
    {
      "name": "pino",
      "npmlink": "https://www.npmjs.com/package/pino",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "Tested and Verified",
      "activitytarget": "Tested and Verified",
      "section": [
        "Logging"
      ]
    },
    {
      "name": "prom-client",
      "npmlink": "https://www.npmjs.com/package/prom-client",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "Tested and Verified",
      "activitytarget": "Tested and Verified",
      "section": [
        "Metrics"
      ]
    },
    {
      "name": "rhea",
      "npmlink": "https://www.npmjs.com/package/rhea",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "Tested and Verified",
      "section": [
        "Message Queuing"
      ]
    },
    {
      "name": "lru-cache",
      "npmlink": "https://www.npmjs.com/package/lru-cache",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Data Caching"
      ]
    },
    {
      "name": "mocha",
      "npmlink": "https://www.npmjs.com/package/mocha",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "foundation": "https://openjsf.org/",
      "section": [
        "Testing"
      ]
    },
    {
      "name": "jest",
      "npmlink": "https://www.npmjs.com/package/jest",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "foundation": "https://openjsf.org/",
      "section": [
        "Testing"
      ]
    },
    {
      "name": "@ibm-cloud/cloudant",
      "npmlink": "https://www.npmjs.com/package/@ibm-cloud/cloudant",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Databases"
      ]
    },
    {
      "name": "nano",
      "npmlink": "https://www.npmjs.com/package/nano",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Databases"
      ]
    },
    {
      "name": "@elastic/elasticsearch",
      "npmlink": "https://www.npmjs.com/package/@elastic/elasticsearch",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Databases"
      ]
    },
    {
      "name": "odbc",
      "npmlink": "https://www.npmjs.com/package/odbc",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Databases"
      ]
    },
    {
      "name": "ibm_db",
      "npmlink": "https://www.npmjs.com/package/ibm_db",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Databases"
      ]
    },
    {
      "name": "mongodb",
      "npmlink": "https://www.npmjs.com/package/mongodb",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Databases"
      ]
    },
    {
      "name": "pg",
      "npmlink": "https://www.npmjs.com/package/pg",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "Tested and Verified",
      "section": [
        "Databases"
      ]
    },
    {
      "name": "kafkajs",
      "npmlink": "https://www.npmjs.com/package/kafkajs",
      "reviewlevel": "Active Watch",
      "activitycurrent": "None",
      "activitytarget": "Tested and Verified",
      "section": [
        "Message Queuing"
      ]
    },
    {
      "name": "@openapitools/openapi-generator-cli",
      "npmlink": "https://www.npmjs.com/package/@openapitools/openapi-generator-cli",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "REST APIs Development"
      ]
    },
    {
      "name": "openapi-backend",
      "npmlink": "https://www.npmjs.com/package/openapi-backend",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "REST APIs Development"
      ]
    },
    {
      "name": "@stoplight/prism-cli",
      "npmlink": "https://www.npmjs.com/package/@stoplight/prism-cli",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "REST APIs Development"
      ]
    },
    {
      "name": "express-openapi-validator",
      "npmlink": "https://www.npmjs.com/package/express-openapi-validator",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "REST APIs Development"
      ]
    },
    {
      "name": "swagger-editor",
      "npmlink": "https://www.npmjs.com/package/swagger-editor",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "REST APIs Development"
      ]
    },
    {
      "name": "openapi-editor",
      "npmlink": "https://www.npmjs.com/package/openapi-editor",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "REST APIs Development"
      ]
    },
    {
      "name": "nyc",
      "npmlink":"https://www.npmjs.com/package/nyc",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Code Coverage"
      ]
    },
    {
      "name": "dotenv",
      "npmlink": "https://www.npmjs.com/package/dotenv",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Secure Development Process"
      ]
    },
    {
      "name": "node-vault",
      "npmlink": "https://www.npmjs.com/package/node-vault",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Secure Development Process"
      ]
    },
    {
      "name": "@ibm-cloud/secrets-manager",
      "npmlink": "https://www.npmjs.com/package/@ibm-cloud/secrets-manager",
      "reviewlevel": "Active Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Secure Development Process"
      ]
    },
    {
      "name": "@opentelemetry/sdk-trace-base",
      "npmlink": "https://www.npmjs.com/package/@opentelemetry/sdk-trace-base",
      "reviewlevel": "Active Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "foundation": "https://www.cncf.io/projects/",
      "section": [
        "Observability"
      ]
    },
    {
      "name": "@opentelemetry/sdk-trace-node",
      "npmlink": "https://www.npmjs.com/package/@opentelemetry/sdk-trace-node",
      "reviewlevel": "Active Watch",
      "activitycurrent": "None",
      "activitytarget": "Tested and Verified",
      "foundation": "https://www.cncf.io/projects/",
      "section": [
        "Observability"
      ]
    },
    {
      "name": "axios",
      "npmlink": "https://www.npmjs.com/package/axios",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Consuming Services"
      ]
    },
    {
      "name": "node-fetch",
      "npmlink": "https://www.npmjs.com/package/node-fetch",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "Consuming Services"
      ]
    },
    {
      "name": "cors",
      "npmlink": "https://www.npmjs.com/package/cors",
      "reviewlevel": "Yearly Watch",
      "activitycurrent": "None",
      "activitytarget": "None",
      "section": [
        "CORS"
      ]
    }
  ],
  "licenses": {
    "allow": [
      "MIT", 
      "Apache-2.0", 
      "Apache 2.0", 
      "ISC", 
      "BSD-2-Clause", 
      "BSD-3-Clause", 
      "Unlicense", 
      "WTFPL", 
      "Unicode-DFS-2016",
      "Unicode-3.0",
      "BlueOak-1.0.0"
    ],
    "rules": {
      "ioredis": {
        "allow": ["Apache"]
      },
      "ibmcloud-appid": {
        "note": "dependency spdx-exceptions,spdx-license-ids uses CC0-1.0 indicates no copyright",
        "note": "dependency spdx-exceptions uses CC-BY-3.0 allows broad use with attribution",
        "allow": ["BSD", "CC0-1.0", "CC-BY-3.0" ]
      },
      "i18next-icu":{
        "allow": ["0BSD"]
      },
      "mocha": {
        "allow": ["Python-2.0"]
      },
      "jest": {
        "allow": ["CC-BY-4.0"]
      },
      "ibm_db": {
        "note": "buffers package that ibm_db depends on specifies MIT indirectly",
        "allow": ["Custom: http://github.com/substack/node-bufferlist"]
      },
      "nyc": {
        "note": "dependency caniuse-lite uses CC-BY-4.0",
        "allow": ["CC-BY-4.0"]
      }, 
      "eslint": {
        "note": "dependency argparse uses licence Python-2.0",
        "allow": ["Python-2.0"]
      },
      "@openapitools/openapi-generator-cli":{
        "allow": ["0BSD"]
      },
      "openapi-backend": {
        "note": "Multiple dependencies use licenses",
        "allow": ["Python-2.0"]
      },
      "express-openapi-validator": {
        "note": "Multiple dependencies use licenses",
        "allow": ["Python-2.0"]
      },
      "swagger-editor": {
        "note": "Multiple dependencies use licenses",
        "note": "depends on jsonify which is under Public Domain",
        "allow": ["Python-2.0","0BSD", "Public Domain", "CC0-1.0"]
      },
      "@stoplight/prism-cli":{
        "note": "dependency tslib@2.3.1 reports 0BSD which is less restrictive than BSD",
        "note": "dependency fastestsmallesttextencoderdecoder@1.0.22 reports CC0-1.0 which gives up all rights", 
        "allow": ["0BSD", "CC0-1.0"]
      },
      "openapi-editor": {
        "note": "dependency caniuse-lite uses CC-BY-4.0",
        "allow": ["CC-BY-4.0"]
      },
      "@elastic/elasticsearch": {
        "note": "dependency tslib@2.3.1 reports 0BSD which is less restrictive than BSD",
        "allow": ["0BSD"]
      },
      "node-rdkafka": {
        "note": "dev depdency on domhandler, domutil and entities which are under BSD like reported as BSD*",
        "note": "depends on argparse which is under Python-2.0",
        "note": "dev dependency toolkit-jsdoc appears to be UNLICENCED (reports as Undefined) and shoujld not be installed, not required for non-dev use",
        "note": "dependency taffydb reports an unknown licence but repo says it is BSD-2-Clause on npm",
        "allow": ["BSD", "Python-2.0", "Undefined", "UNKNOWN"]
      },
      "mongodb": {
        "note": "dependency tslib@2.3.1 reports 0BSD which is less restrictive than BSD",
        "allow": ["0BSD"]
      },
      "@ibm-cloud/secrets-manager": {
        "note": "dependency npm uses Artistic-2.0 which allows any use but no modifications",
        "note": "dependency spdx-exceptions,spdx-license-ids uses CC0-1.0 indicates no copyright",
        "note": "dependency spdx-exceptions uses CC-BY-3.0 allows broad use with attribution",
        "note": "dependency argparse@2.0.1 uses Python-2.0",
        "allow": ["Artistic-2.0", "CC0-1.0", "CC-BY-3.0", "Python-2.0" ]
      },
      "@opentelemetry/sdk-trace-base": {
        "note": "dependency tslib@2.6.0 uses which is less restrictive than BSD",
         "allow": ["0BSD" ]
      },
      "@opentelemetry/sdk-trace-node": {
        "note": "dependency tslib@2.6.0 uses which is less restrictive than BSD",
         "allow": ["0BSD" ]
      }
    }
  },
  "citgm": {
    "note-1" : "ibmcloud-appid, @ibm-cloud/cloudant, opossum, ibm_db are Red Hat/IBM modules that would need broader usage before being considered for CITGM",
    "note-2" : "cldr-localenames-full does not have tests as it is a data delivery module and therefore does not beong in CITGM",
    "note-3" : "eslint and mocha look to be permanently skipped in CIGTM due to needing headless chrome to run tests",
    "note-4" : "node-rdkafka, rhea, odbc, @openapitools/openapi-generator-cli, openapi-backend, @stoplight/prism-http, express-openapi-validator, swagger-editor, openapi-editor have low download numbers and will be skipped in CITGM",
    "note-5" : "kafkajs, @elastic/elasticsearch, helmet, passport propose additions to CITGM in the future",
    "note-6" : "nano, express-prom-bundle, i18next-icu, i18next-http-middleware, i18next-fs-backend review in the future to see if they make sense to add to CITGM",
    "skip": [
      "ibmcloud-appid",
      "@ibm-cloud/cloudant",
      "opossum",
      "ibm_db",
      "cldr-localenames-full",
      "eslint",
      "mocha",
      "node-rdkafka",
      "rhea",
      "odbc",
      "@openapitools/openapi-generator-cli",
      "openapi-backend",
      "@stoplight/prism-http",
      "express-openapi-validator",
      "swagger-editor",
      "openapi-editor",
      "kafkajs",
      "@elastic/elasticsearch",
      "helmet",
      "passport",
      "nano",
      "express-prom-bundle",
      "i18next-icu",
      "i18next-http-middleware",
      "i18next-fs-backend"
    ]
  },
  "audit": {
    "allow": {
      "CVE-2022-0235": [{
        "note": ["opencollective uses an old version of node-fetch. opencollective is used to ask for funding and the reported vulnerability is not a concern in that module",
                 "an older version of node-fetch is also used by swagger-editor through isomorphic-fetch, Red Hat and Synk both assessed the node-fetch vuln as medium instead of high as reported by npm so suppress related failures"],
        "name": "node-fetch",
        "effects": ["isomorphic-fetch", "opencollective"]
      }],
      "CVE-2021-44906": [{
        "note": ["opencollective uses an old version of minimist. opencollective is used to ask for funding and the reported vulnerability is not a concern in that module"],
        "note": ["mocha uses an old version of mkdirp. mocha is used for testing and the proptotype pollution vuln is not a concern in that module"],
        "name": "minimist",
        "effects": ["opencollective", "mkdirp"]
      }],
      "CVE-2020-7598": [{
        "note": ["opencollective uses an old version of minimist. opencollective is used to ask for funding and the reported vulnerability is not a concern in that module"],
        "name": "minimist",
        "effects": ["opencollective"]
      }],
      "CVE-2020-15168": [{
        "note": ["swagger-editor uses an old version of minimist. opencollective is used to ask for funding and the reported vulnerability is not a concern in that module"],
        "note": ["swagger-editor isomorphic-fetch which uses node-fetch. The github and CVE list the severity as low/medium, while what is returned by the query to the github db says high in one place and low in the other. This is unlikely to be an issue in use in swagger-editor and it seems like the rating should be low so just allow"],
        "note": ["swagger-client uses cross-fetch which uses node-fetch. The github and CVE list the severity as low/medium, while what is returned by the query to the github db says high in one place and low in the other. This is unlikely to be an issue in use in swagger-editor and it seems like the rating should be low so just allow"],
        "name": "node-fetch",
        "effects": ["isomorphic-fetch", "cross-fetch", "opencollective"]
      }],
      "CVE-2022-3517": [{
        "note": ["node-rdkafka uses a version of mocha that uses an old version of minimatch, as mocha is a test package used in dev, the ReDoS impact/risk is likely low"],
        "name": "minimatch",
        "effects": ["mocha"]
      }]
    }
  }
}