How to fix 6 high severity vulnerabilities npm audit fix --force - security

I'm getting above mentioned error and it says to address all issues (including breaking changes), run audit fix --force
when i run npm audit command, it gives following details
npm WARN config global `--global`, `--local` are deprecated. Use `--location=global` instead.
npm ERR! code ENOLOCK
npm ERR! audit This command requires an existing lockfile.
npm ERR! audit Try creating one first with: npm i --package-lock-only
npm ERR! audit Original error: loadVirtual requires existing shrinkwrap file
npm ERR! A complete log of this run can be found in:
npm ERR! C:\Users\User\AppData\Local\npm-cache\_logs\2022-06-18T17_42_41_740Z-debug-0.log

Related

ERESOLVE unable to resolve dependency tree ionic capacitor

I am trying to build ionic app and this error shows:
ionic build
> vue-cli-service build
[INFO] Looks like #vue/cli-service isn't installed in this project.
This package is required for this command to work properly.
? Install #vue/cli-service? Yes
> npm i -D -E #vue/cli-service
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR!
npm ERR! While resolving: ionic-files#0.0.1
npm ERR! Found: #capacitor/core#2.4.6
npm ERR! node_modules/#capacitor/core
npm ERR! #capacitor/core#"2.4.6" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer #capacitor/core#"~2.5.0" from #capacitor/android#2.5.0
npm ERR! node_modules/#capacitor/android
npm ERR! #capacitor/android#"^2.4.6" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR!
npm ERR! See /home/sariful/.npm/eresolve-report.txt for a full report.
npm ERR! A complete log of this run can be found in:
npm ERR! /home/sariful/.npm/_logs/2022-11-07T09_21_25_101Z-debug-0.log
[ERROR] An error occurred while running subprocess npm.
npm i -D -E #vue/cli-service exited with exit code 1.
Re-running this command with the --verbose flag may provide more information.
USE COMMAND
npm install --force for install npm
and if you want to install any other dependency then just add --force tag
after you command.
The error seem pretty self-explainatory, to point out which part: retry this command with --force, or --legacy-peer-deps
Differences between the two:
--legacy-peer-deps: ignore all peerDependencies when installing, in the style of npm version 4 through version 6.
--force: will force npm to fetch remote resources even if a local copy exists on disk.
For more info: npm: When to use --force and --legacy-peer-deps
From personal experience such similar package issues can be fixed by upgrading NPM version, or I prefer to use NVM so I can switch back and forth the NPM versions, but caution: this can break your other packages, so I suggest you to try the first solution first.

Installing a react package without --force or --legacy-peer-deps

I am trying to work with redux saga (React 18.2.0), I configured the store, the reducer and the request, so to do the API call I decided to inject the reducer and saga using useInjectReducer and useInjectSaga from redux-injectors :
import { useInjectReducer, useInjectSaga } from 'redux-injectors';
the problem is that when I try to install redux-injectors I got this error:
npm install redux-injectors
npm WARN config global `--global`, `--local` are deprecated. Use `--location=global` instead.
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR!
npm ERR! While resolving: test-socle#0.1.0
npm ERR! Found: react#18.2.0
npm ERR! node_modules/react
npm ERR! react#"^18.2.0" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer react#"^16.6.0 || ^17.0.0" from redux-injectors#2.0.0
npm ERR! node_modules/redux-injectors
npm ERR! redux-injectors#"*" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR!
npm ERR! See C:\Users\Admin\AppData\Local\npm-cache\eresolve-report.txt for a full report.
npm ERR! A complete log of this run can be found in:
npm ERR! C:\Users\Admin\AppData\Local\npm-cache\_logs\2022-09-25T09_19_46_303Z-debug-0.log
I locked up for the solution, and I found that I need to add --legacy-peer-deps or --force while installing, this solution works fine in my local machine, but it will not work at the dev environment because at this environment we install dependencies only using npm install

Error while running npm install #material-ui/core in VSCode in windows

PS C:\Users\misss\tnodejs_ec> npm install #material-ui/core
npm WARN config global --global, --local are deprecated. Use --location=global instead.
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR!
npm ERR! While resolving: tnodejs_ec#0.1.0
npm ERR! Found: react#18.2.0
npm ERR! node_modules/react
npm ERR! react#"18.2.0" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer react#"^16.8.0 || ^17.0.0" from #material-ui/core#4.12.4
npm ERR! node_modules/#material-ui/core
npm ERR! #material-ui/core#"*" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR!
npm ERR! See C:\Users\misss\AppData\Local\npm-cache\eresolve-report.txt for a full report.
npm ERR! A complete log of this run can be found in:
npm ERR! C:\Users\misss\AppData\Local\npm-cache_logs\2022-07-04T09_27_24_111Z-debug-0.log
PS C:\Users\misss\tnodejs_ec>
If you really want to install material UI then use force to npm no matter what happen you have to install this forcefully.
npm install #material-ui/core --force
MUI doesn't work with React18, its because of an issue in previous release of MUI, now its been fixed in the latest version.
If you want to stick to #material-ui/core#4.12.4 then your best bet is to include the --legacy-peer-deps option. I got it working after adding this option like
npm install #material-ui/core --legacy-peer-deps
However, the best way forward is to update to the latest MUI version. Current version of MUI is v5.10.1
PS: with recent updates the name of the package in NPM registry has been updated too
old: #material-ui/core
new: #mui/material
Don't forget to update your package.json

Trying to find a solution to multiple Vue.JS Project Dependency Errors from the book Fullstack Vue: The Complete Guide to Vue.js

I am receiving the following errors when I try to run a Vue.js calendar app on Vue3 from this tutorial here
https://github.com/zfhui/fullstack-vue/tree/master/02-calendar_app
I am running the following versions: npm 8.12.1 and node v16.15.1
I receive the following errors when I try to run it using npm install and/or npm run dev:
npm WARN config global `--global`, `--local` are deprecated. Use `--location=global` instead.
npm WARN config production Use `--omit=dev` instead.
npm WARN config production Use `--omit=dev` instead.
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR!
npm ERR! While resolving: babel-loader#7.1.5
npm ERR! Found: webpack#5.73.0
npm ERR! node_modules/webpack
npm ERR! dev webpack#"^5.72.1" from the root project
npm ERR! peer webpack#"4.x.x || 5.x.x" from #webpack-cli/configtest#1.1.1
npm ERR! node_modules/#webpack-cli/configtest
npm ERR! #webpack-cli/configtest#"^1.1.1" from webpack-cli#4.9.2
npm ERR! node_modules/webpack-cli
npm ERR! dev webpack-cli#"^4.9.2" from the root project
npm ERR! 3 more (#webpack-cli/configtest, #webpack-cli/info, #webpack-cli/serve)
npm ERR! 6 more (css-loader, terser-webpack-plugin, vue-loader, ...)
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer webpack#"2 || 3 || 4" from babel-loader#7.1.5
npm ERR! node_modules/babel-loader
npm ERR! dev babel-loader#"^7.1.2" from the root project
npm ERR!
npm ERR! Conflicting peer dependency: webpack#4.46.0
npm ERR! node_modules/webpack
npm ERR! peer webpack#"2 || 3 || 4" from babel-loader#7.1.5
npm ERR! node_modules/babel-loader
npm ERR! dev babel-loader#"^7.1.2" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR!
npm ERR! See C:\Users\NotAgainLarry\AppData\Local\npm-cache\eresolve-report.txt for a full report.
npm ERR! A complete log of this run can be found in:
npm ERR! C:\Users\NotAgainLarry\AppData\Local\npm-cache\_logs\2022-06-03T06_24_14_414Z-debug-0.log
When I try to resolve the error by running npm audit fix --force, npm i or npm run dev, I get the following:
calendar-app#1.0.0 dev > cross-env NODE_ENV=development webpack-dev-server --open --hot [[100;90m..................[0m] -
: [32;40mtiming[0m [35mconfig:load:flatten[0m Completed in 3ms[0m[K [..................]
- : timing config:load:fla[webpack-cli] Invalid configuration object. Webpack has been initialized using a configuration object that does not match the API schema.
- configuration.devtool should match pattern "^(inline-|hidden-|eval-)?(nosources-)?(cheap-(module-)?)?source-map$". BREAKING CHANGE since webpack 5: The devtool option is more strict.
Please strictly follow the order of the keywords in the pattern.
How do I get rid of these errors? And what does it mean by 'Please strictly follow the order of the keywords in the patter'?
It's a problem caused by a change on NPM. You can read more about it here:
https://github.com/npm/cli/issues/4998
Basically, the dependencies expected are not the ones npm is downloading.
How I fixed:
Pin your node version to 16.15.0 (you can do that with nvm)
Delete your node_modules and package-lock.json
npm install --legacy-peer-deps

create-react-app not generating package.lock file

Today I worked on a react web project. So it worked fine.And then after that I created a another react project. But in that there was no any package.lock file. So I created manually it by using npm install . But after that when I'm adding dependency to that project with npm i react-particles-js command I got a error msg like this.
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR!
npm ERR! While resolving: smart-parking-system#0.1.0
npm ERR! Found: react#17.0.2
npm ERR! node_modules/react
npm ERR! react#"^17.0.2" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer react#"^16.0.0" from react-particles-js#3.5.3
npm ERR! node_modules/react-particles-js
npm ERR! react-particles-js#"*" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR!
npm ERR! See C:\Users\User.LAPTOP-3EBUUP6S\AppData\Local\npm-cache\eresolve-report.txt for a full report.
npm ERR! A complete log of this run can be found in:
npm ERR! C:\Users\User.LAPTOP-3EBUUP6S\AppData\Local\npm-cache\_logs\2021-09-02T11_17_21_426Z-debug.log
Also when I'm creating package.lock file manually I get this log message.
npm WARN old lockfile
npm WARN old lockfile The package-lock.json file was created with an old version of npm,
npm WARN old lockfile so supplemental metadata must be fetched from the registry.
npm WARN old lockfile
npm WARN old lockfile This is a one-time fix-up, please be patient...
npm WARN old lockfile
npm WARN deprecated sane#4.1.0: some dependency vulnerabilities fixed, support for node < 10 dropped, and newer ECMAScript syntax/features added
npm WARN deprecated uuid#3.4.0: Please upgrade to version 7 or higher. Older versions may use Math.random() in certain circumstances, which is known to be problematic. See https://v8.dev/blog/math-random for details.
changed 87 packages, and audited 1703 packages in 40s
So the problem is why I'm not getting a package.lock file automatically and why I can't install dependencies correctly?
It can be because creat-react-app is using yarn now.
Instead of npm install use yarn
Instead of npm i react-particles-js use yarn add react-particle-js
You can confirm if you have a yarn.lock file

Resources