update npm / third-party libraries

[Lorsbyjm]

create new branch
run npm audit and check whats wrong
for more information talk to Lukas :D

---

Remaining alerts:

• pouchdb-authentication uses outdated url-parse (fixed, npm release pending: High vulnerability pouchdb-community/pouchdb-authentication#249)
• @angular-devkit/build-angular uses outdated webpack-dev-server (to be fixed soon: webpack-dev-server vulnerability angular/angular-cli#13342)

[sleidig]

npm audit shows security vulnerabilities of our dependencies/libraries. Seems to be the same as what github is analysing: https://github.com/NGO-DB/ndb-core/network/alerts ?

I think someone should look into a major update of all libraries, including to Angular 7 (run npm outdated for an overview of latest versions).
Any volunteers?

[liwde]

The Angular CLI seems to have some tools to support especially major version upgrades: https://angular.io/cli/update

However, some things already made their way into #204 -- we should wait, until this is merged, before branching and getting conflicts in the package-lock.json.

[RichardNutt]

see https://update.angular.io/

Before Updating

• Switch from HttpModule and the Http service to HttpClientModule and the HttpClient service. HttpClient simplifies the default ergonomics (You don't need to map to json anymore) and now supports typed return values and interceptors. Read more on angular.io
• Remove deprecated RxJS 6 features using rxjs-tslint auto update rules
• Once you and all of your dependencies have updated to RxJS 6, remove rxjs-compat.
• If you use the Angular Service worker, migrate any versionedFiles to the files array. The behavior is the same.

During the Update

• Angular now uses TypeScript 3.1, read more about any potential breaking changes
• Update to v7 of the core framework and CLI by running ng update @angular/cli @angular/core in your terminal
• Update Angular Material to v7 by running ng update @angular/material in your terminal. You should test your application for sizing and layout changes.

After the Update

• Stop using matRippleSpeedFactor and baseSpeedFactor for ripples, using Animation config instead.

[sleidig]

I think we'll have to pin the typescript dependency to <3.2 for the time being.