Skip to main content

Miscellaneous Commands Reference

Volume 1 — Core Developer Skills

This is a reference for any commands that will be useful for various tasks

EF Core Migration Commands​

Command to generate sql script based on the last migration ran.​

    dotnet ef migrations script AddFolders AddDocumentRecords \
        --project Waypoint.API.Infrastructure \
        --startup-project Waypoint.API.Web \
        --output ~/Development/Projects/Traxs/Waypoint/WaypointDb/Documents.sql --idempotent

npm audit fixes​

Summary — the general playbook for future audits:

  1. Run npm audit fix first, and re-run it once more — it's not always one-shot; fixing one package can free up room to fix another on a second pass (that's what took you 31→26 here).

  2. For what's left, check who's actually pinning the vulnerable version (npm ls <package>). If it's a transitive dependency held back by an intermediate package that hasn't bumped its own package.json range yet — not your direct dependency — npm audit fix literally cannot cross that boundary. That's what qs, uuid, and serialize-javascript were: all three had patched versions published upstream, but express, sockjs, and the webpack plugins hadn't updated their own declared ranges. That's what overrides in package.json is for — it lets you force a specific nested dependency to a newer version regardless of what the parent declares. Scope it to the specific parent (as I did) rather than a bare top-level override, or you risk silently downgrading/upgrading that package everywhere else it's used in the tree (would've clobbered mermaid's uuid@14.0.1 here).

  3. Before trusting an override, sanity-check it's not a breaking major-version jump for that consumer's API — these three are small, stable-API libraries only used at dev/build time, so low risk. Then npm install and rebuild to confirm nothing broke.

  4. "No fix available" some genuinely means no fix exists yet — image-size is already at its latest published version and is still vulnerable; there's nothing to bump to. That one just needs to be tracked (revisit occasionally, or open/watch the upstream issue) since it's a build-time-only DoS risk on files you control, not something exposed to site visitors.

Changes made: package.json (added the overrides block) and the resulting package-lock.json update. Let me know if you'd like these committed.

roundtrip-ops@0.0.0 /Users/pete/Development/Projects/Traxs/roundtrip-ops
├─┬ @docusaurus/core@3.10.2
│ ├─┬ @docusaurus/bundler@3.10.2
│ │ ├─┬ copy-webpack-plugin@11.0.0
│ │ │ └── serialize-javascript@7.1.1
│ │ └─┬ css-minimizer-webpack-plugin@5.0.1
│ │   └── serialize-javascript@7.1.1
│ └─┬ webpack-dev-server@5.2.6
│   ├─┬ express@4.22.1
│   │ ├─┬ body-parser@1.20.8
│   │ │ └── qs@6.16.0 deduped
│   │ └── qs@6.16.0
│   └─┬ sockjs@0.3.24
│     └── uuid@11.1.1
└─┬ @docusaurus/theme-mermaid@3.10.2
  └─┬ mermaid@11.16.1
    └── uuid@14.0.1