npm: moved build-time dependencies to devDependencies section, explicit npm audit (#1497)

app/Makefile

@@ -5,7 +5,8 @@ include ../tools/tools.mk
 deps: node_modules/.up-to-date
 
 node_modules/.up-to-date: $(npm) package.json package-lock.json
-	$(retry) $(npm) $(npm_flags) install
+	$(retry) $(npm) $(npm_flags) install --no-audit
+	$(npm) $(npm_flags) audit --production
 	echo updated > node_modules/.up-to-date
 
 electron_builder_flags+=-c.extraMetadata.version=$(KOPIA_VERSION:v%=%)

app/package.json

@@ -10,7 +10,6 @@
     "electron-updater": "^4.3.9",
     "react": "^17.0.2",
     "react-dom": "^17.0.2",
-    "react-scripts": "^4.0.3",
     "uuid": "^8.3.2"
   },
   "author": {
@@ -116,7 +115,8 @@
     "concurrently": "^6.3.0",
     "electron": "^15.3.0",
     "electron-builder": "^22.13.1",
-    "electron-notarize": "^1.1.1"
+    "electron-notarize": "^1.1.1",
+    "react-scripts": "^4.0.3"
   },
   "homepage": "./",
   "description": "Fast and secure open source backup.",

htmlui/Makefile

@@ -7,7 +7,8 @@ build-html: build/index.html
 deps: node_modules/.up-to-date
 
 install:
-	$(npm) install
+	$(npm) install --no-audit
+	$(npm) audit --production
 
 dev: node_modules/.up-to-date
 	$(npm) $(npm_flags) run start

htmlui/package.json

@@ -7,18 +7,11 @@
     "@fortawesome/free-regular-svg-icons": "^5.15.4",
     "@fortawesome/free-solid-svg-icons": "^5.15.4",
     "@fortawesome/react-fontawesome": "^0.1.16",
-    "@testing-library/jest-dom": "^5.14.1",
-    "@testing-library/react": "^12.1.2",
-    "axios": "^0.24.0",
     "bootstrap": "^5.1.3",
     "moment": "^2.29.1",
-    "postcss": "^8.3.11",
-    "pretty": "^2.0.0",
-    "react": "^17.0.2",
     "react-bootstrap-v5": "^1.4.0",
     "react-dom": "^17.0.2",
     "react-router-dom": "^5.3.0",
-    "react-scripts": "^4.0.3",
     "react-table": "^7.7.0"
   },
   "scripts": {
@@ -44,6 +37,13 @@
     ]
   },
   "devDependencies": {
+    "@testing-library/jest-dom": "^5.15.0",
+    "@testing-library/react": "^12.1.2",
+    "axios": "^0.24.0",
+    "postcss": "^8.3.11",
+    "pretty": "^2.0.0",
+    "react": "^17.0.2",
+    "react-scripts": "^4.0.3",
     "axios-mock-adapter": "^1.20.0",
     "enzyme": "^3.11.0",
     "enzyme-adapter-react-16": "^1.15.6"