I'm new to NPM. I'm getting an alert from github dependabot saying my json-schema package is vulnerable. My current json-schema version is 0.2.3, it's required by my current npm@7.20.6 via transitive dependency on jsprim@1.4.1. I can't update my npm version right now since that involves lots of testing which I don't have time to do right now. Wondering what's a good way to force npm to use a newer version of json-schema. (0.4.0 is the version I should use.) I was thinking updating package-lock.json to use json-schema@0.2.3, but if I run npm install, that change will be erased right? Some examples would be appreciated!
0 Answers
Related