Skip to content

Latest commit

 

History

History
41 lines (31 loc) · 1.43 KB

README.md

File metadata and controls

41 lines (31 loc) · 1.43 KB

How to fix vulnerabilities in npm packages

Changelog

  • 20210901 - Updated with advice from Stack Overflow, first do a sanity check (source at end of document)

Description

After running npm install lite-server the installation reported 1 high severity vulnerability found in one or more of the dependencies.

Sanity check

  • Do a sanity check
  • In case it's a real problem, check the repository of vulnerable package for existing issues and PRs
  • In case there's none, submit an issue
  • Fork a repository or use use existing PR as git dependency until it's fixed in NPM release
  • In case of nested dependencies, do this at several levels of nesting
  • Most times it's expected that you won't advance beyond a sanity check.

Simple fix

$ npm audit fix

Manual fix

When running a simple npm audit fix doesn't work, and there are still vulnerabilites, add this to your package.json, where packagename is the package with the vulnerability, and ^0.0.0 is the version suggested by the npm audit tool.

  "resolutions": {
    "packagename": "^0.0.0"
  }

After this, run the following command to fix the dependency.

$ npx npm-force-resolutions

The vulnerability should be fixed!

Source