I have 5 moderate severity vulnerabilities when I checked the npm audit. How can I fix these errors given below?

Question

npm audit report

glob-parent <5.1.2 Severity: moderate Regular expression denial of service - https://npmjs.com/advisories/1751 No fix available node_modules/webpack-dev-server/node_modules/glob-parent chokidar 1.0.0-rc1 - 2.1.8 Depends on vulnerable versions of glob-parent node_modules/webpack-dev-server/node_modules/chokidar webpack-dev-server 2.0.0-beta - 3.11.2 Depends on vulnerable versions of chokidar node_modules/webpack-dev-server @angular-devkit/build-angular <=13.0.0-next.2 Depends on vulnerable versions of @angular-devkit/build-webpack Depends on vulnerable versions of webpack-dev-server node_modules/@angular-devkit/build-angular @angular-devkit/build-webpack <=0.1300.0-next.2 Depends on vulnerable versions of webpack-dev-server node_modules/@angular-devkit/build-webpack

5 moderate severity vulnerabilities

Some issues need review, and may require choosing a different dependency.

Answer 1

These are vulnerabilities discovered and reported for dependencies your application is using. Generally, you will want to fix these by updating packages to the latest versions containing fixes for the vulnerabilities.

There is a command, npm audit fix, which can update the affected dependencies for you in most cases (It took me personally from 10.000+ to roughly 10 reports). This however by default will only use non-breaking version jumps (so by semantic versioning it will not jump a major version for example).

You can use npm audit fix --force to fix the remaining vulnerabilities (including semver-incompatible ones) if there are package updates, however you will need to look for breaking changes in the updated packages that may conflict with your program logic.

I highly recommend you look at the NPM Docs article below, it explains the whole process very well.

Also see:

• Auditing package dependencies for security vulnerabilities
• What does "npm audit fix" exactly do?