enter image description hereI am trying to UIKitCatalog app for simulator.
- Downloaded zip file from : https://github.com/appium/ios-uicatalog
- Unzip the folder
- Open the terminal and navigate to the UIKitCatalog folder
- Build the app by command npm install
Problem: I am facing 11 vulnerabilities (2 moderate, 9 high). What did i try to resolve : i tried npm audit fix and npm audit fix --force commands but still unable to resolve them. Please guide me how to resolve it.
**********************************************************************************
# npm audit report
glob-parent <5.1.2
Severity: high
glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex - https://github.com/advisories/GHSA-ww39-953v-wcq6
fix available via `npm audit fix --force`
Will install gulp@3.9.1, which is a breaking change
node_modules/chokidar/node_modules/glob-parent
node_modules/glob-stream/node_modules/glob-parent
chokidar 1.0.0-rc1 - 2.1.8
Depends on vulnerable versions of glob-parent
node_modules/chokidar
glob-watcher >=3.0.0
Depends on vulnerable versions of chokidar
node_modules/glob-watcher
gulp >=4.0.0
Depends on vulnerable versions of glob-watcher
Depends on vulnerable versions of vinyl-fs
node_modules/gulp
appium-gulp-plugins >=3.0.0
Depends on vulnerable versions of gulp
Depends on vulnerable versions of gulp-debug
Depends on vulnerable versions of gulp-mocha
Depends on vulnerable versions of mocha
node_modules/appium-gulp-plugins
gulp-debug >=4.0.0
Depends on vulnerable versions of gulp
node_modules/gulp-debug
gulp-mocha >=7.0.0
Depends on vulnerable versions of gulp
Depends on vulnerable versions of mocha
node_modules/gulp-mocha
glob-stream 5.3.0 - 6.1.0
Depends on vulnerable versions of glob-parent
node_modules/glob-stream
vinyl-fs >=2.4.2
Depends on vulnerable versions of glob-stream
node_modules/vinyl-fs
nanoid 3.0.0 - 3.1.30
Severity: moderate
Exposure of Sensitive Information to an Unauthorized Actor in nanoid - https://github.com/advisories/GHSA-qrpm-p2h7-hrv2
fix available via `npm audit fix`
node_modules/nanoid
mocha 8.2.0 - 9.1.4
Depends on vulnerable versions of nanoid
node_modules/mocha
11 vulnerabilities (2 moderate, 9 high)
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force