# Removing vulnerabilities in new project (v1 app skeleton)

**URL:** <https://discourse.aurelia.io/t/removing-vulnerabilities-in-new-project-v1-app-skeleton/4726>\
**Category:** Help Requests\
**Created:** [April 12, 2022, 1:19am UTC](https://discourse.aurelia.io/t/removing-vulnerabilities-in-new-project-v1-app-skeleton/4726 "2022-04-12T01:19:00Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![dem](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/dem/32/2281_2.png) [@dem](https://discourse.aurelia.io/u/dem)\
**Post date:** [April 12, 2022, 1:19am UTC](https://discourse.aurelia.io/t/removing-vulnerabilities-in-new-project-v1-app-skeleton/4726/1 "2022-04-12T01:19:00Z")

</div>

Hi,

How should I remove all the security vulnerabilities when starting a new project using “au new”. Some of these seem quite severe:

> dem@MacBook temp % npm i -g aurelia-cli  
> npm WARN deprecated source-map-url@0.4.1: (removed URL)  
> npm WARN deprecated urix@0.1.0: Please see (removed URL)  
> npm WARN deprecated resolve-url@0.2.1: (removed URL)  
> npm WARN deprecated source-map-resolve@0.5.3: See (removed URL)  
> npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.  
> npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies  
> npm WARN deprecated querystring@0.2.0: The querystring API is considered Legacy. new code should use the URLSearchParams API instead.

NNote: I had to remove the URL’s from the warnings above to post this message

If it matters, I’m using Node 16 LTS and am trying to create a default Typescript app.

Sorry, I’m pretty much a complete beginner with this stuff.

Thank you for any pointers.

David

---

<div class="post-metadata">

**Author:** ![huochunpeng](https://avatars.discourse-cdn.com/v4/letter/h/49beb7/32.png) [@huochunpeng](https://discourse.aurelia.io/u/huochunpeng)\
**Post date:** [April 12, 2022, 7:57am UTC](https://discourse.aurelia.io/t/removing-vulnerabilities-in-new-project-v1-app-skeleton/4726/2 "2022-04-12T07:57:20Z")

</div>

Unfortunately, except querystring, the rest are all dependencies of gulp v4.  
Gulp v4 has not released any new version for 3 years ☹

---

<div class="post-metadata">

**Author:** ![dem](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/dem/32/2281_2.png) [@dem](https://discourse.aurelia.io/u/dem)\
**Post date:** [April 12, 2022, 1:54pm UTC](https://discourse.aurelia.io/t/removing-vulnerabilities-in-new-project-v1-app-skeleton/4726/3 "2022-04-12T13:54:28Z")

</div>

Hi,

Thank you very much for your response. Definitely a bit disappointing to need to wait for a Gulp update. The Gulp forum makes it seem like v5 should be coming “soon”, but that is a very impressively broad library…

I need to assume that external vulnerability scanning tools will notice these outdated libraries, which would cause us problems with government clients.

There does not seem to be a path forward for v1 at this time.

Best regards,

David

---

<div class="post-metadata">

**Author:** ![milkshakeuk](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/milkshakeuk/32/1207_2.png) [@milkshakeuk](https://discourse.aurelia.io/u/milkshakeuk)\
**Post date:** [April 12, 2022, 3:05pm UTC](https://discourse.aurelia.io/t/removing-vulnerabilities-in-new-project-v1-app-skeleton/4726/4 "2022-04-12T15:05:55Z")

</div>

@dem you do not need gulp to use aurelia v1, we use webpack for our bundling, are there other skeletons for v1 that do not use gulp?

@huochunpeng ^^

---

<div class="post-metadata">

**Author:** ![zewa666](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/zewa666/32/19_2.png) [@zewa666](https://discourse.aurelia.io/u/zewa666)\
**Post date:** [April 12, 2022, 4:15pm UTC](https://discourse.aurelia.io/t/removing-vulnerabilities-in-new-project-v1-app-skeleton/4726/5 "2022-04-12T16:15:48Z")

</div>

for audits you’d actually inspect the prod dependencies as that is what you ship. Gulp is merely a devdependency for building your app

---

<div class="post-metadata">

**Author:** ![huochunpeng](https://avatars.discourse-cdn.com/v4/letter/h/49beb7/32.png) [@huochunpeng](https://discourse.aurelia.io/u/huochunpeng)\
**Post date:** [April 12, 2022, 4:35pm UTC](https://discourse.aurelia.io/t/removing-vulnerabilities-in-new-project-v1-app-skeleton/4726/6 "2022-04-12T16:35:46Z")

</div>

aurelia-cli uses gulp to drive all those “au” commands like “au generate” and “au build”.

---

<div class="post-metadata">

**Author:** ![dem](https://yyz1.discourse-cdn.com/flex027/user_avatar/discourse.aurelia.io/dem/32/2281_2.png) [@dem](https://discourse.aurelia.io/u/dem)\
**Post date:** [April 12, 2022, 11:52pm UTC](https://discourse.aurelia.io/t/removing-vulnerabilities-in-new-project-v1-app-skeleton/4726/7 "2022-04-12T23:52:34Z")

</div>

Thank you all for taking the time to explain this to me.

As I mentioned, I’m a complete beginner at this.

Best regards,

David