Update packages and base images to fix possible vulnerabilities.

nodejs10/CHANGELOG.md

@@ -3,12 +3,103 @@
 ## Migrating from `nodejs:8` to `nodejs:10`
 - The `cloudant` npm package is not available in `nodejs:10`, the package is deprecated, you need to use the official npm package [@cloudant/cloudant](https://www.npmjs.com/package/@cloudant/cloudant) v3.x when importing the nodejs module (i.e `require('@cloudant/cloudant')`) also [v3.x only returns Promises](https://github.com/cloudant/nodejs-cloudant/blob/master/api-migration.md#2x--3x).
 - The `watson-developer-cloud` npm package available in `nodejs:10` is version 4.x. This version includes support for Promises. [A list of the changes made is documented](https://github.com/watson-developer-cloud/node-sdk/blob/master/UPGRADE-4.0.md).
+ *Attention:* This package is deprecated and is not supported anymore. It will not receive updates and will be removed in the future. Move your action to the successor package `ibm-watson`.
 - The `ibm-watson` npm package available in `nodejs:10` is version 4.x. This package is the successor of package `watson-developer-cloud`. Upgrade your action code to this new package, since the former will not receive updates anymore. This version includes support for Promises. [A list of the changes made is documented](https://github.com/watson-developer-cloud/node-sdk/blob/master/UPGRADE-4.0.md).
+- The package `ibmiotf` has been renamed by the maintainers to `@wiotp/sdk`. Make sure to update your action code to the new package. See https://www.npmjs.com/package/@wiotp/sdk for all changes. The package `ibmiotf` will not receive updates anymore and will be removed from this runtime in the future.
+
+# 1.15.0
+Changes:
+ - update to a newer base image to catch security fixes
+ - add @wiotp/sdk `0.6.2` (successor of package `ibmiotf`)
+ - update ibm_db from `2.5.2` to `2.6.3`
+ - update jsforce from `1.9.1` to `1.9.3`
+ - update marked from `0.6.2` to `0.8.0` (https://npmjs.com/advisories/812)
+
+NodeJS version:
+ - [10.19.0](https://nodejs.org/en/blog/release/v10.19.0)
+
+NPM Packages:
+ - [@cloudant/cloudant v3.0.2](https://www.npmjs.com/package/@cloudant/cloudant) - This is the official Cloudant library for Node.js.
+ - [@ibm-functions/iam-token-manager v1.0.4](https://www.npmjs.com/package/@ibm-functions/iam-token-manager) - This is an IAM access token manager library for Node.js.
+ - [@sendgrid/mail v6.3.1](https://www.npmjs.com/package/@sendgrid/mail) - Provides email support via the SendGrid API.
+ - [@wiotp/sdk v0.6.2](https://www.npmjs.com/package/@wiotp/sdk) - IBM Watson IoT Platform Javascript SDK.
+ - [amqplib v0.5.3](https://www.npmjs.com/package/amqplib) - A library for making AMQP 0-9-1 clients for Node.JS.
+ - [apn v2.2.0](https://www.npmjs.com/package/apn) - A Node.js module for interfacing with the Apple Push Notification service.
+ - [async v2.6.2](https://www.npmjs.com/package/async) - Provides functions for working with asynchronous functions.
+ - [bent v1.3.0](https://www.npmjs.com/package/bent) - Functional HTTP client for Node.js w/ async/await.
+ - [body-parser v1.18.3](https://www.npmjs.com/package/body-parser) - Parse incoming request bodies in a middleware before your handlers, available under the req.body property.
+ - [btoa v1.2.1](https://www.npmjs.com/package/btoa) - A port of the browser's btoa function.
+ - [cassandra-driver v4.0.0](https://www.npmjs.com/package/cassandra-driver) - DataStax Node.js Driver for Apache Cassandra.
+ - [commander v2.19.0](https://www.npmjs.com/package/commander) - The complete solution for node.js command-line interfaces.
+ - [composeaddresstranslator v1.0.4](https://www.npmjs.com/package/composeaddresstranslator) - Address translator from Compose UI or API for Scylla databases.
+ - [consul v0.34.1](https://www.npmjs.com/package/consul) - A client for Consul, involving service discovery and configuration.
+ - [cookie-parser v1.4.4](https://www.npmjs.com/package/cookie-parser) - Parse Cookie header and populate req.cookies with an object keyed by the cookie names.
+ - [elasticsearch v15.4.1](https://www.npmjs.com/package/elasticsearch) - The official low-level Elasticsearch client for Node.js.
+ - [errorhandler v1.5.1](https://www.npmjs.com/package/errorhandler) - Development-only error handler middleware.
+ - [etcd3 v0.2.11](https://www.npmjs.com/package/etcd3) - A high-quality, production-ready client for the Protocol Buffer-based etcdv3 API.
+ - [express v4.16.4] (https://www.npmjs.com/package/express) - Fast, unopinionated, minimalist web framework for node.
+ - [express-session v1.15.6] (https://www.npmjs.com/package/express-session) - Managing sessions for express.
+ - [formidable v1.2.1](https://www.npmjs.com/package/formidable) - A Node.js module for parsing form data, especially file uploads.
+ - [glob v7.1.4](https://www.npmjs.com/package/glob) - Match files using the patterns the shell uses, like stars and stuff.
+ - [gm v1.23.1](https://www.npmjs.com/package/gm) - GraphicsMagick and ImageMagick for Node.
+ - [ibm-cos-sdk v1.5.0](https://www.npmjs.com/package/ibm-cos-sdk) - {{site.data.keyword.cos_full}} SDK for Node.js
+ - [ibm_db v2.6.3](https://www.npmjs.com/package/ibm_db) - An asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix.
+ - [ibmiotf v0.2.41](https://www.npmjs.com/package/ibmiotf) - The node.js client is used for simplifying the interaction with the IBM Watson Internet of Things Platform.
+ - [ibm-watson v4.2.1](https://www.npmjs.com/package/ibm-watson) - Node.js client library to use the Watson APIs.
+ - [iconv-lite v0.4.24](https://www.npmjs.com/package/iconv-lite) - Pure JS character encoding conversion
+ - [jsdom v13.2.0](https://www.npmjs.com/package/jsdom) - jsdom is a pure-JavaScript implementation of many web standards, notably the WHATWG DOM and HTML Standards.
+ - [jsforce v1.9.3](https://www.npmjs.com/package/jsforce)Salesforce API Library for JavaScript applications.
+ - [jsonwebtoken v8.5.1](https://www.npmjs.com/package/jsonwebtoken) - An implementation of JSON Web Tokens.
+ - [lodash v4.17.13](https://www.npmjs.com/package/lodash) - The Lodash library exported as Node.js modules.
+ - [log4js v4.0.2](https://www.npmjs.com/package/log4js) - This is a conversion of the log4js framework to work with Node.
+ - [marked v0.6.2](https://www.npmjs.com/package/marked) - A full-featured markdown parser and compiler, written in JavaScript. Built for speed.
+ - [merge v1.2.1](https://www.npmjs.com/package/merge) - Merge multiple objects into one, optionally creating a new cloned object.
+ - [moment v2.24.0](https://www.npmjs.com/package/moment) - A lightweight JavaScript date library for parsing, validating, manipulating, and formatting dates.
+ - [mongodb v3.3.4](https://www.npmjs.com/package/mongodb) - The official MongoDB driver for Node.js.
+ - [mustache v3.0.1](https://www.npmjs.com/package/mustache) - mustache.js is an implementation of the mustache template system in JavaScript.
+ - [mysql v2.16.0](https://www.npmjs.com/package/mysql) - This is a node.js driver for mysql.
+ - [nano v8.0.0](https://www.npmjs.com/package/nano) - minimalistic couchdb driver for Node.js.
+ - [nodemailer v5.1.1](https://www.npmjs.com/package/nodemailer) - Send e-mails from Node.js – easy as cake!
+ - [oauth2-server v3.0.1](https://www.npmjs.com/package/oauth2-server) - Complete, compliant and well tested module for implementing an OAuth2 Server/Provider with express in Node.js.
+ - [openwhisk v3.19.0](https://www.npmjs.com/package/openwhisk) - JavaScript client library for the OpenWhisk platform. Provides a wrapper around the OpenWhisk APIs.
+ - [path-to-regex v3.0.0](https://www.npmjs.com/package/path-to-regexp) - Turn a path string such as /user/:name into a regular expression which can then be used to match against URL paths.
+ - [pg v7.11.0](https://www.npmjs.com/package/pg) - Non-blocking PostgreSQL client for node.js. Pure JavaScript and optional native libpq bindings.
+ - [process v0.11.10](https://www.npmjs.com/package/process) - require('process'); just like any other module.
+ - [pug v2.0.4](https://www.npmjs.com/package/pug) - Implements the Pug templating language.
+ - [redis v2.8.0](https://www.npmjs.com/package/redis) - This is a complete and feature rich Redis client for Node.js.
+ - [request v2.88.0](https://www.npmjs.com/package/request) - Request is designed to be the simplest way possible to make HTTP calls.
+ - [request-promise v4.2.4](https://www.npmjs.com/package/request-promise) - The simplified HTTP request client 'request' with Promise support. Powered by Bluebird.
+ - [rimraf v2.6.3](https://www.npmjs.com/package/rimraf) - The UNIX command rm -rf for node.
+ - [semver v5.6.0](https://www.npmjs.com/package/semver) - Semantic Versioning for Nodejs
+ - [serialize-error v3.0.0](https://www.npmjs.com/package/serialize-error) - Serialize an error into a plain object.
+ - [serve-favicon v2.5.0](https://www.npmjs.com/package/serve-favicon) - Node.js middleware for serving a favicon.
+ - [socket.io v2.2.0](https://www.npmjs.com/package/socket.io) - Socket.IO enables real-time bidirectional event-based communication.
+ - [socket.io-client v2.2.0](https://www.npmjs.com/package/socket.io-client) - Realtime application framework for socket.io.
+ - [superagent v4.1.0](https://www.npmjs.com/package/superagent) - SuperAgent is a small progressive client-side HTTP request library, and Node.js module with the same API, sporting many high-level HTTP client features.
+ - [swagger-tools v0.10.4](https://www.npmjs.com/package/swagger-tools) - Package that provides various tools for integrating and interacting with Swagger.
+ - [tmp v0.0.33](https://www.npmjs.com/package/tmp) - A simple temporary file and directory creator for node.js.
+ - [twilio v3.28.0](https://www.npmjs.com/package/twilio) - A wrapper for the Twilio API, related to voice, video, and messaging.
+ - [underscore v1.9.1](https://www.npmjs.com/package/underscore) - Underscore.js is a utility-belt library for JavaScript that provides support for the usual functional suspects (each, map, reduce, filter...) without extending any core JavaScript objects.
+ - [url-pattern v1.0.3](https://www.npmjs.com/package/url-pattern) - Parse URLs for path parameters more easily than from using a regex string matcher.
+ - [uuid v3.3.2](https://www.npmjs.com/package/uuid) - Simple, fast generation of RFC4122 UUIDS.
+ - [validator v10.11.0](https://www.npmjs.com/package/validator) - A library of string validators and sanitizers.
+ - [vcap_services v0.7.0](https://www.npmjs.com/package/vcap_services)Parse and return service credentials from VCAP_SERVICES environment variable that IBM Cloud provides.
+ - [watson-developer-cloud v4.0.0-rc2](https://www.npmjs.com/package/watson-developer-cloud) - Node.js client library to use the Watson Developer Cloud services, a collection of APIs that use cognitive computing to solve complex problems.
+ - [when v3.7.8](https://www.npmjs.com/package/when) - When.js is a rock solid, battle-tested Promises/A+ and when() implementation, including a complete ES6 Promise shim.
+ - [winston v3.2.1](https://www.npmjs.com/package/winston) - A multi-transport async logging library for node.js. "CHILL WINSTON! ... I put it in the logs."
+ - [ws v6.1.4](https://www.npmjs.com/package/ws) - ws is a simple to use, blazing fast, and thoroughly tested WebSocket client and server implementation.
+ - [xlsx v0.14.3](https://www.npmjs.com/package/xlsx) - Parser and writer for various spreadsheet formats.
+ - [xml2js v0.4.19](https://www.npmjs.com/package/xml2js) - Simple XML to JavaScript object converter. It supports bi-directional conversion.
+ - [xmlhttprequest v1.8.0](https://www.npmjs.com/package/xmlhttprequest) - node-XMLHttpRequest is a wrapper for the built-in http client to emulate the browser XMLHttpRequest object.
+ - [yauzl v2.10.0](https://www.npmjs.com/package/yauzl) - yet another unzip library for node. For zipping.
+ - [yazl v2.5.1](https://www.npmjs.com/package/yazl) - yet another zip library for node. For unzipping, see yauzl.
+
 
 # 1.14.1
 Changes:
  - update to a newer base image to catch fixes
 
+
 # 1.14.0
 Changes:
  - update to a newer base image to catch fixes

nodejs10/Dockerfile

@@ -1,6 +1,22 @@
-FROM openwhisk/action-nodejs-v10:3e843c0
+FROM openwhisk/action-nodejs-v10:7aca443
+
 COPY ./package.json /
-RUN cd / && npm install --production \
- && npm cache clean --force
+
+RUN apt-get update \
+ # Update some installed packages to get security fixes.
+ && apt-get install -y --no-install-recommends e2fsprogs file git openssl subversion \
+ # Cleanup apt data, we do not need them later on.
+ && rm -rf /var/lib/apt/lists/* \
+ # We do not have mysql-server installed but mysql-common contains config files (/etc/mysql/my.cnf) for it.
+ # We need to add some dummy entries to /etc/mysql/my.cnf to sattisfy vulnerability checking of it.
+ && echo "\n[mysqld]\nssl-ca=/tmp/ca.pem\nssl-cert=/tmp/server-cert.pem\nssl-key=/tmp/server-key.pem\n" >> /etc/mysql/my.cnf \
+ # Start adding/updating npm packages.
+ && cd / \
+ && npm install --production \
+ # Do some cleanup of not used npm install artifacts.
+ && npm cache clean --force \
+ && rm -rf /root/.cache/node-gyp \
+ # Replace default openwhisk main with an iam enabled version.
+ && sed -i.bak 's/lib\/main.js/lib\/iam-openwhisk-main.js/' /node_modules/openwhisk/package.json
+
 COPY iam-client/iam-openwhisk-main.js /node_modules/openwhisk/lib/
-RUN sed -i.bak 's/lib\/main.js/lib\/iam-openwhisk-main.js/' /node_modules/openwhisk/package.json

nodejs10/package.json

@@ -1,6 +1,6 @@
 {
  "name": "ibm-functions-runtime-nodejs-v10",
- "version": "1.14.1",
+ "version": "1.15.0",
  "description": "IBM Functions",
  "repository": {
  "type": "git",
@@ -9,8 +9,9 @@
  "license": "Apache-2.0",
  "dependencies": {
  "@cloudant/cloudant": "3.0.2",
- "@ibm-functions/iam-token-manager": "1.0.3",
+ "@ibm-functions/iam-token-manager": "1.0.4",
  "@sendgrid/mail": "6.3.1",
+ "@wiotp/sdk": "0.6.2",
  "amqplib": "0.5.3",
  "apn": "2.2.0",
  "async": "2.6.2",
@@ -31,16 +32,16 @@
  "glob": "7.1.4",
  "gm": "1.23.1",
  "ibm-cos-sdk": "1.5.0",
- "ibm_db": "2.5.2",
+ "ibm_db": "2.6.3",
  "ibmiotf": "0.2.41",
  "ibm-watson": "4.2.1",
  "iconv-lite": "0.4.24",
  "jsdom": "13.2.0",
- "jsforce": "1.9.1",
+ "jsforce": "1.9.3",
  "jsonwebtoken": "8.5.1",
  "lodash": "4.17.13",
  "log4js": "4.0.2",
- "marked": "0.6.2",
+ "marked": "0.8.0",
  "merge": "1.2.1",
  "moment": "2.24.0",
  "mongodb": "3.3.4",

nodejs12/CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Migrating from `nodejs:10` to `nodejs:12`
  - The ibm-watson sdk version moved to 5.x. It includes a number of breaking changes. See https://github.com/watson-developer-cloud/node-sdk/blob/HEAD/MIGRATION-V5.md for details.
+ - The `ibmiotf` package is renamed to `@wiotp/sdk`. See https://www.npmjs.com/package/@wiotp/sdk for all changes.
 
 # 1.0.0
 Initial release.
@@ -16,6 +17,7 @@ NPM Packages:
  - [@cloudant/cloudant v4.2.3](https://www.npmjs.com/package/@cloudant/cloudant) - This is the official Cloudant library for Node.js.
  - [@ibm-functions/iam-token-manager v1.0.4](https://www.npmjs.com/package/@ibm-functions/iam-token-manager) - This is an IAM access token manager library for Node.js.
  - [@sendgrid/mail v6.5.2](https://www.npmjs.com/package/@sendgrid/mail) - Provides email support via the SendGrid API.
+ - [@wiotp/sdk v0.6.2](https://www.npmjs.com/package/@wiotp/sdk) - IBM Watson IoT Platform Javascript SDK.
  - [amqplib v0.5.5](https://www.npmjs.com/package/amqplib) - A library for making AMQP 0-9-1 clients for Node.JS.
  - [apn v2.2.0](https://www.npmjs.com/package/apn) - A Node.js module for interfacing with the Apple Push Notification service.
  - [async v3.1.1](https://www.npmjs.com/package/async) - Provides functions for working with asynchronous functions.
@@ -40,7 +42,6 @@ NPM Packages:
  - [gm v1.23.1](https://www.npmjs.com/package/gm) - GraphicsMagick and ImageMagick for Node.
  - [ibm-cos-sdk v1.6.0](https://www.npmjs.com/package/ibm-cos-sdk) - {{site.data.keyword.cos_full}} SDK for Node.js
  - [ibm_db v2.6.3](https://www.npmjs.com/package/ibm_db) - An asynchronous/synchronous interface for node.js to IBM DB2 and IBM Informix.
- - [ibmiotf v0.2.41](https://www.npmjs.com/package/ibmiotf) - The node.js client is used for simplifying the interaction with the IBM Watson Internet of Things Platform.
  - [ibm-watson v5.3.1](https://www.npmjs.com/package/ibm-watson) - A node.js client library to use the Watson APIs.
  - [iconv-lite v0.5.1](https://www.npmjs.com/package/iconv-lite) - Pure JS character encoding conversion.
  - [jest v25.1.0](https://www.npmjs.com/package/jest) - Delightful JavaScript Testing.

nodejs12/Dockerfile

@@ -1,4 +1,4 @@
-FROM openwhisk/action-nodejs-v12:3e843c0
+FROM openwhisk/action-nodejs-v12:7aca443
 
 COPY ./package.json /
 
@@ -19,4 +19,4 @@ RUN apt-get update \
  # Replace default openwhisk main with an iam enabled version.
  && sed -i.bak 's/lib\/main.js/lib\/iam-openwhisk-main.js/' /node_modules/openwhisk/package.json
 
-COPY iam-client/iam-openwhisk-main.js /node_modules/openwhisk/lib/
+COPY iam-client/iam-openwhisk-main.js /node_modules/openwhisk/lib/

nodejs12/package.json

@@ -11,10 +11,11 @@
  "@cloudant/cloudant": "4.2.3",
  "@ibm-functions/iam-token-manager": "1.0.4",
  "@sendgrid/mail": "6.5.2",
+ "@wiotp/sdk": "0.6.2",
  "amqplib": "0.5.5",
  "apn": "2.2.0",
  "async": "3.1.1",
- "bent": "7.0.5",
+ "bent": "7.0.6",
  "body-parser": "1.18.3",
  "btoa": "1.2.1",
  "bufferutil": "4.0.1",
@@ -35,19 +36,18 @@
  "gm": "1.23.1",
  "ibm-cos-sdk": "1.6.0",
  "ibm_db": "2.6.3",
- "ibmiotf": "0.2.41",
- "ibm-watson": "5.3.1",
+ "ibm-watson": "5.4.0",
  "iconv-lite": "0.5.1",
  "jest": "25.1.0",
- "jsdom": "16.1.0",
+ "jsdom": "16.2.0",
  "jsforce": "1.9.3",
  "jsonwebtoken": "8.5.1",
  "lodash": "4.17.15",
  "log4js": "6.1.2",
  "marked": "0.8.0",
  "merge": "1.2.1",
  "moment": "2.24.0",
- "mongodb": "3.5.2",
+ "mongodb": "3.5.3",
  "mustache": "4.0.0",
  "mysql": "2.18.1",
  "nano": "8.1.0",
@@ -59,10 +59,10 @@
  "process": "0.11.10",
  "pug": "2.0.4",
  "redis": "2.8.0",
- "request": "2.88.0",
+ "request": "2.88.2",
  "request-promise": "4.2.5",
  "rimraf": "3.0.2",
- "semver": "7.1.2",
+ "semver": "7.1.3",
  "serialize-error": "3.0.0",
  "serve-favicon": "2.5.0",
  "socket.io": "2.3.0",