Fix Security Issues

.gitignore

@@ -1,3 +1,5 @@
 test/test
 coverage/
 .nyc_output/
+node_modules/
+package-lock.json

CHANGELOG.md

@@ -1,3 +1,10 @@
+# v3.1.0
+
+- Fixes several security issues
+  - Replaces `dyno` with `@mapbox/dyno` package
+  - Replaces `dynamodb-test` with `@mapbox/dynamodb-test`
+  - Removes some unused dependencies
+
 # v3.0.0
 
 Breaks cardboard up into a collection of repos where each repo represents one type of index.

eslint.config.cjs

@@ -0,0 +1,23 @@
+// eslint.config.cjs
+const js = require("@eslint/js");
+
+module.exports = [
+    js.configs.recommended,
+    {
+        languageOptions: {
+            globals: {
+                process: "readonly",
+                module: "readonly",
+                require: "readonly",
+                __dirname: "readonly",
+                setTimeout: "readonly",
+            },
+        },
+        rules: {
+            indent: ["error", 4],
+            quotes: ["error", "single"],
+            "no-console": "off",
+            // "no-unused-vars": ["warn"],
+        },
+    },
+];

index.js

@@ -1,4 +1,4 @@
-var Dyno = require('dyno');
+var Dyno = require('@mapbox/dyno');
 
 module.exports = Cardboard;
 

lib/stream-helper.js

@@ -1,4 +1,4 @@
-var Dyno = require('dyno');
+var Dyno = require('@mapbox/dyno');
 
 /**
  * Sets up a stream handler by filtering out actions that don't target the desired actions

package.json

@@ -28,32 +28,31 @@
   },
   "homepage": "https://github.com/mapbox/cardboard",
   "dependencies": {
+    "@mapbox/dyno": "^1.6.2",
+    "@mapbox/geojson-extent": "^1.0.1",
     "aws-sdk": "2.x",
     "buffer-from": "^0.1.1",
     "cuid": "1.2.4",
-    "dyno": "^1.4.0",
     "geobuf": "^3.0.0",
-    "geojson-extent": "^0.1.0",
     "geojson-normalize": "0.0.0",
-    "lodash": "~2.4.1",
-    "minimist": "0.0.9",
+    "lodash": "^4.17.21",
+    "minimist": "^1.2.8",
     "pbf": "^3.0.4",
     "queue-async": "~1.0.7",
     "sphericalmercator": "^1.0.3",
     "through2": "^2.0.0",
     "tilebelt": "^0.5.2"
   },
   "devDependencies": {
-    "coveralls": "^2.11.2",
-    "documentation": "^3.0.0",
-    "dynalite": "^1.0.2",
-    "dynamodb-test": "^0.2.1",
-    "eslint": "^1.4.3",
+    "@eslint/js": "^9.23.0",
+    "@mapbox/dynamodb-test": "^0.6.2",
+    "dynalite": "^3.2.2",
+    "eslint": "^9.23.0",
     "geojson-fixtures": "0.1.0",
     "geojson-random": "^0.2.2",
     "geojson-stream": "0.0.0",
-    "mock-aws-s3": "^0.2.1",
-    "nyc": "^6.4.4",
+    "mock-aws-s3": "^4.0.2",
+    "nyc": "^17.1.0",
     "tape": "^4.6.3"
   }
 }

test/batch.test.js

@@ -3,7 +3,7 @@ var path = require('path');
 var fixtures = require('./fixtures');
 var states = JSON.parse(fs.readFileSync(path.resolve(__dirname, 'data', 'states.geojson'), 'utf8'));
 
-var mainTable = require('dynamodb-test')(require('tape'), 'cardboard', require('../lib/main-table.json'));
+var mainTable = require('@mapbox/dynamodb-test')(require('tape'), 'cardboard', require('../lib/main-table.json'));
 
 var config = {
     region: 'test',

test/cli.test.js

@@ -7,7 +7,7 @@ var cmd = path.resolve(__dirname, '..', 'bin', 'cardboard.js');
 var _ = require('lodash');
 
 
-var mainTable = require('dynamodb-test')(require('tape'), 'cardboard', require('../lib/main-table.json'));
+var mainTable = require('@mapbox/dynamodb-test')(require('tape'), 'cardboard', require('../lib/main-table.json'));
 
 var config = {
     region: 'test',

test/config.test.js

@@ -1,8 +1,8 @@
 var Cardboard = require('../');
 var _ = require('lodash');
-var Dyno = require('dyno');
+var Dyno = require('@mapbox/dyno');
 
-var mainTable = require('dynamodb-test')(require('tape'), 'cardboard', require('../lib/main-table.json'));
+var mainTable = require('@mapbox/dynamodb-test')(require('tape'), 'cardboard', require('../lib/main-table.json'));
 
 var config = {
     region: 'test',

test/fixtures.js

@@ -6,7 +6,6 @@ module.exports.random = function() {
 
 module.exports.USA = {
     type: 'Feature',
-    properties: {},
     geometry: {
         type: 'Polygon',
         coordinates: [
@@ -41,8 +40,7 @@ module.exports.nullIsland = {
     geometry: {
         type: 'Point',
         coordinates: [0, 0]
-    },
-    properties: {}
+    }
 };
 
 module.exports.dc = {
@@ -53,8 +51,7 @@ module.exports.dc = {
             -77.02875137329102,
             38.93337493490118
         ]
-    },
-    properties: {}
+    }
 };
 
 module.exports.haiti = {
@@ -93,7 +90,6 @@ module.exports.haiti = {
 
 module.exports.haitiLine = {
     type: 'Feature',
-    properties: {},
     geometry: {
         type: 'LineString',
         coordinates: [

test/indexing.test.js

@@ -4,7 +4,7 @@ var Pbf = require('pbf');
 var geobuf = require('geobuf');
 var fixtures = require('./fixtures');
 
-var mainTable = require('dynamodb-test')(require('tape'), 'cardboard', require('../lib/main-table.json'));
+var mainTable = require('@mapbox/dynamodb-test')(require('tape'), 'cardboard', require('../lib/main-table.json'));
 
 var config = {
     region: 'test',

test/setup.js

@@ -21,7 +21,7 @@ var dynoConfig = {
     endpoint: 'http://localhost:4567'
 };
 
-var dyno  = require('dyno')(dynoConfig);
+var dyno  = require('@mapbox/dyno')(dynoConfig);
 
 module.exports.setup = function(done) {
     dynalite = Dynalite({

test/stream-helper.test.js

@@ -1,5 +1,5 @@
 var test = require('tape');
-var Dyno = require('dyno');
+var Dyno = require('@mapbox/dyno');
 var streamHelper = require('../lib/stream-helper');
 
 test('handlers removes', function(assert) {

test/table.test.js

@@ -12,7 +12,7 @@ var config = {
     endpoint: 'http://localhost:4567'
 };
 
-var dyno = require('dyno')({
+var dyno = require('@mapbox/dyno')({
     table: 'fake',
     region: 'fake',
     endpoint: 'http://localhost:4567'

test/utils.test.js

@@ -5,7 +5,7 @@ var geobuf = require('geobuf');
 var test = require('tape');
 
 var states = fs.readFileSync(path.resolve(__dirname, 'data', 'states.geojson'), 'utf8');
-states = JSON.parse(states);
+states = JSON.parse(states);  // eslint-disable-line no-unused-vars
 
 var utils = require('../lib/utils');