Deployment breaks due to faulty version of colors.js

[tlylt]

Tell us about your environment
Windows

• MarkBind Version:
  Possibly most versions of Markbind are affected when installing dependencies either locally or in CI

What did you do? Please include the actual source code causing the issue.
When running an update in this commit to the CS3218 Website, the action failed to complete. As it turns out, there are discussions on the "bug" in colors.js. Specifically for our case, it seems like the live-server package that we depend on is using the latest version of colors.js. There is a PR in the live-server repo 2 days ago to fix the issue but it has not been merged.

According to the discussions, the solution seems to be pinning all usage of the colors.js package to 1.4.0.
To fix the issue temporarily, we could possibly use https://www.npmjs.com/package/npm-force-resolution
Or, should we wait for live-server to update?

Related:

• https://www.bleepingcomputer.com/news/security/dev-corrupts-npm-libs-colors-and-faker-breaking-thousands-of-apps/

What did you expect to happen?
Deploy successfully.

What actually happened? Please include the actual, raw output.

[jonahtanjz]

Thanks for looking into this @tlylt 👍

According to the discussions, the solution seems to be pinning all usage of the colors.js package to 1.4.0.
To fix the issue temporarily, we could possibly use https://www.npmjs.com/package/npm-force-resolution
Or, should we wait for live-server to update?

Since this breaks deployment and it's quite urgent, I guess we can try pinning colors.js in live-server to 1.4.0 temporarily first and then revert back once live-server has merged their PR as this might take a while since the project hasn't been in active development.

[damithc]

Since this breaks deployment and it's quite urgent, I guess we can try pinning colors.js in live-server to 1.4.0 temporarily first and then revert back once live-server has merged their PR as this might take a while since the project hasn't been in active development.

Yes, if it breaks deployments, we need to fix it ASAP.

[ang-zeyu]

Looking at package-lock there are 3 higher level dependencies, relying on various versions of colors:

• live-server latest
• winston 1.0.3
  • relies on logform ^1.2.1

@jonahtanjz @tlylt let's try adding colors: "1.4.0" as a direct dependency of markbind-cli and doing a release, it may be able to supercede the above 3 versions.

The fix in #1705 may not work in our case as package-lock isn't published, and we aren't relying on webpack / etc. to bundle the cli app.

[ang-zeyu]

If that fails (or as a longer term fix), we can try moving the entire live-server implementation over (https://github.com/tapio/live-server) which should be fairly quick since we've already patched the single file @ryoarmanda.

(then transfering its dependencies as appropriate)