moderate severity vulnerabilities with angular

0
votes

I am developing a web application with Angular but I have a problem installing json server. Please help me correct this problem.

Depends on vulnerable versions of browserslist node_modules/react-dev-utils react-scripts >=0.10.0-alpha.328cb32e Depends on vulnerable versions of @pmmmwh/react-refresh-webpack-plugin Depends on vulnerable versions of react-dev-utils Depends on vulnerable versions of webpack-dev-server node_modules/react-scripts

glob-parent <5.1.2 Severity: moderate Regular expression denial of service - https://npmjs.com/advisories/1751 fix available via npm audit fix --force Will install [email protected], which is a breaking change node_modules/react-scripts/node_modules/glob-parent node_modules/watchpack-chokidar2/node_modules/glob-parent node_modules/webpack-dev-server/node_modules/glob-parent chokidar 1.0.0-rc1 - 2.1.8 Depends on vulnerable versions of glob-parent node_modules/react-scripts/node_modules/webpack-dev-server/node_modules/chokidar node_modules/watchpack-chokidar2/node_modules/chokidar node_modules/webpack-dev-server/node_modules/chokidar watchpack-chokidar2 * Depends on vulnerable versions of chokidar node_modules/watchpack-chokidar2 watchpack 1.7.2 - 1.7.5 Depends on vulnerable versions of watchpack-chokidar2 node_modules/react-scripts/node_modules/watchpack webpack 4.44.0 - 4.46.0 Depends on vulnerable versions of watchpack node_modules/react-scripts/node_modules/webpack webpack-dev-server 2.0.0-beta - 3.11.2 Depends on vulnerable versions of chokidar node_modules/react-scripts/node_modules/webpack-dev-server node_modules/webpack-dev-server @angular-devkit/build-angular * Depends on vulnerable versions of @angular-devkit/build-webpack Depends on vulnerable versions of webpack-dev-server node_modules/@angular-devkit/build-angular @angular-devkit/build-webpack * Depends on vulnerable versions of webpack-dev-server node_modules/@angular-devkit/build-webpack @pmmmwh/react-refresh-webpack-plugin 0.3.1 - 0.5.0-beta.4 Depends on vulnerable versions of webpack-dev-server node_modules/react-scripts/node_modules/@pmmmwh/react-refresh-webpack-plugin react-scripts >=0.10.0-alpha.328cb32e Depends on vulnerable versions of @pmmmwh/react-refresh-webpack-plugin Depends on vulnerable versions of react-dev-utils Depends on vulnerable versions of webpack-dev-server node_modules/react-scripts

12 moderate severity vulnerabilities

To address issues that do not require attention, run: npm audit fix

To address all issues possible (including breaking changes), run: npm audit fix --force

Some issues need review, and may require choosing a different dependency.

enter image description here

enter image description here

2
node.jsangularnpmwebpack

2 Answers

0
votes

It's just a warning to let you know that there is some known vulnerabilities on the packages you using in your project.

vulnerabilities can be missbehavior, bugs, crashes, security vulnerabilities, etc...

npm keep tracks of known vulnerabilities of all the npm packages. So basiacally you have to wait updates on your package to fix the vulnerability, you can also try to use a different version of the package, or use a different package.

0
votes

Duplicate of : how to solve this npm glob-parent problem Answer: ​https://stackoverflow.com/a/68342168/158649

As it is a dev dependency, not a big deal,

npm update [email protected] --depth 4

has no effect on the npm audit message.

npm audit warnings can be a little bit boy-crying-wolf sometimes.

npm install [email protected] --save-dev

does remove the warning but not really much to worry about.