Resolve dependency warnings in Docker build

[aflinchb]

Description:

• Described in Readme: https:/retaildevcrews/helium-typescript#warnings

• npm WARN deprecated @opentelemetry/[email protected]: Package renamed to @opentelemetry/api

  • See tracking issue, description

• npm WARN deprecated [email protected]: request has been deprecated

  • See jsdom tracking issue and adal tracking issue, description

• npm WARN [email protected] requires a peer of canvas@^2.5.0 but none is installed. You must install peer dependencies yourself.

  • See tracking issue

The original warnings (above) are all resolved and removed from the readme. The remaining are:

• npm WARN [email protected] requires a peer of gulp@>=4 but none is installed. You must install peer dependencies yourself.
  • Still needs investigation as to what the impact is here - so far, it has had no impact on app performance/functionality
• npm WARN optional SKIPPING OPTIONAL DEPENDENCY: [email protected] (node_modules/fsevents):
  • after initial research, this warning is optional and does not affect the app so no further action is needed
• npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for [email protected]: wanted {"os":"darwin","arch":"any"} (current: {"os":"linux","arch":"x64"})
  • after initial research, this warning is optional and does not affect the app so no further action is needed

[tobiaswright]

I've done some research on the issue, and appears there is no way around having to add gulp to the package.json.

I've installed gulp and it does generate two new warning, similar to the warning that are being generated now. The screenshot below is the new warning that are generated.

This is current warning for reference:

I narrowed the package that is causing that issue. It's inversify-restify-utils - I believe there that the this module should be in developer dependencies.

I can't recall if this the module with the absentee owner.

At any rate installing gulp does not appear to have any adverse on the app, and it has passed webvalidate test

[tobiaswright]

The other thing we may want to consider is turning adjusting the log level for npm - https://docs.npmjs.com/misc/config

[tobiaswright]

Oh, also, we wouldn’t see the other two warnings on a Mac: https://stackoverflow.com/questions/27686889/npm-install-warn-on-dependency

[tobiaswright]

So adding gulp does add a low severity vulnerability, it will not be fixed in the current version of gulp: gulpjs/gulp-cli#207