When I run npm update -g, I get this enormous list of vulnerabilities on the screenshot
I tried to globally update npm to the latest version, and I tried to install npm-check-updates. I updated something with it, and now ncu -g gives me 'All global packages are up to date'.
npm audit fix and npm audit fix --force don't do anything.
Yet, all the vulnerabilities are still here. What can I do about it?
Here's list of globally installed packages I have:
And here's the output of npm audit fix and npm audit fix --force while I'm in the directory where the global packages are installed:
If I delete package-lock.json, npm audit fix doesn't run at all and wants me to initialize npm in this global packages directory with package-json.only. After doing so, it gives me the output from above.
How can I fix these vulnerabilites? Or do I need to care about them at all?
Related
Can anyone please tell me why react- router- dom is not installing in my vs-code and how to fix it.
It showing 6 high vulnerability, I also run npm audit fix --force and npm audit but nothing happened.
Please tell me how to remove these vulnerability
Just tried it, react-router-dom installs and also works on your part as I can see.
Try to fix the vulnerabilities by doing these steps:
npm outdated // run to check outdated npm packages
npx npm-check-updates -u // run to check updates outdated npm packages
npm install // run to update npm packages
Source: https://stackoverflow.com/a/70920497/12772716
Whenever I run the command npm install package-name, it doesn't show any error and it also does not install the package(no node_modules folder, just does nothing). Here is the kind of message I get:
up to date, audited 248 packages in 11s
8 packages are looking for funding run npm fund for details
19 vulnerabilities (6 moderate, 9 high, 4 critical)
To address issues that do not require attention, run: npm audit fix
To address all issues (including breaking changes), run: npm audit
fix --force
Run npm audit for details.
I have also tried npm i package-name and npm install --save package-name, but all give the same message. I'm currently using Node version 18.12.1.
What could I be doing wrong and what could be causing this issue?
In order to install npm packages locally, you should run the
npm init
command first.
A file called package.json will be created which contains basic information about the project and the dependencies used in it.
Then in the same directory run the installation command.
Silly me. The fix was to initialize npm in the folder. I ran npm init -y and everything works fine now.
I'm trying to install react native on my Mac through the terminal using "sudo npm install -g expo-cli" but at the end of the installation errors appear.
115 packages are looking for funding
run `npm fund` for details
31 vulnerabilities (19 moderate, 12 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
Run `npm audit` for details.
Before trying to install react native I obviously installed nodeJS (16) in its latest version.
Anyone have an idea why the installation doesn't work?
when I do "npm audit fix" this is what it says:
npm ERR! code ENOLOCK
npm ERR! audit This command requires an existing lockfile.
npm ERR! audit Try creating one first with: npm i --package-lock-only
npm ERR! audit Original error: loadVirtual requires existing shrinkwrap file
Thank you in advance for your help.
Good news!
The first block you're referring to does not indicate installation failure. Your packages were installed correctly. The warnings are for nested security vulnerabilities which you can choose to address or ignore, depending on your app.
To prove that it was installed, run npm list -g in your terminal and see if expo-cli is in the list.
You can also check the packages installed correctly by creating a new react app using
npx create-react-app my-app
cd my-app
npm start
npm audit fix is intended to automatically upgrade / fix vulnerabilities in npm packages
There is something I don't understand with how npm audit fix works. From the docs:
npm audit fix runs a full-fledged npm install under the hood
So why when I run npm install and see audit vulnerabilities do I have to run npm audit fix manually to fix them?
npm install without any arguments will just install the dependencies in your package-lock.json (assuming it exists). npm audit fix will use the audit information to figure out what dependencies need to be upgraded and install them, as long as they don't conflict with your package.json.
I have this error whenever I install a package
found 14 vulnerabilities (1 low, 1 moderate, 12 high) run `npm audit fix` to fix them, or `npm audit` for details
So I have found out that some of my npm packages have a vulnerable version of a
dependency called tar. So all I need to do now is update this package to a higher version >= 4.4.2.
I manually changed the versions of all the tar dependencies in my package-lock.json and have tried to run the following commands
npm i
npm audit fix
npm audit fix --force
but the package-lock.json updates itself back to it's previous tar dependencies. I even ran npm cache clean --force and repeated the above command but the same result.
Is there a way I can specifically update every tar dependency within my node_modules from the command line?
npm audit fix changes package.json if needed by changing package versions to compatible ones, and package.json defines the possible versions that appear in package-lock.json.
So, you can't fix version-based vulnerabilities by rewriting package-lock.json because npm install rewrites package-lock.json anyway.
npm audit fix rewrites the versions in package.json to compatible versions that don't suffer from vulnerabilities. If running npm audit fix doesn't fix your version-based vulnerability issues, you have to refactor your code by using versions/libs that are not entirely compatible in the eyes of npm audit fix (in the real world, the changes are usually very minor). You can use the help of npm list to get the name of the dependency that requires an invalid version of tar, and change the version of this package.