Hey everyone,

Well, that was a false start.

After my post yesterday about fixing up the master branch of the ssc_tokens_history repo, @forkyishere kindly pointed out that I was essentially polishing a museum exhibit. Turns out, the community actually uses the hive branch. It relies on MongoDB instead of Postgres and is generally "more" updated.

I switched branches to take a look. If I thought the last one was dusty, this one was a hazard. npm audit screamed 37 vulnerabilities at me, including critical ones.

So, I rolled up my sleeves for Round Two.

The Cleanup (PR #34)

I’ve submitted Pull Request #34, which is a much more aggressive cleanup than the last one.

• Link: https://github.com/hive-engine/ssc_tokens_history/pull/34

What I Changed:

• Dead Code Removal: Since the hive branch uses MongoDB, the pg (Postgres) dependency was useless weight. I removed it entirely.
• Fixing Dependency Hell: The old setup was trying to use eslint-config-airbnb, which pulls in a bunch of React dependencies we don't need for a backend service. I swapped it for eslint-config-airbnb-base and pinned eslint to v8. This resolved the peer dependency conflicts that were previously breaking clean installs.
• Security Overrides: Added overrides for axios and diff. These were buried deep in the dependency tree and causing critical/high-severity flags.
• Fixing the Tests: Updating sscjs broke a test in tokens.js because the new library returns an extra issuer field. I updated the test logic to handle the new data structure correctly.

The Result

We are down to 0 vulnerabilities.

I verified the changes by running the full test suite (npm run test-all), and all 26 tests passed. Best of all, npm install now runs cleanly without needing any --force flags.

Bonus

Even though it works it does give some warnings, I put in PR #35: https://github.com/hive-engine/ssc_tokens_history/pull/35 to address those as well, so I guess it depends on if warnings are acceptable.

Thanks to @forkyishere for the heads-up. Now the actual infrastructure is secure.

As always,
Michael Garcia a.k.a. TheCrazyGM