npm audit fix not fixing low vulnerability

user_7180331 0
Viewed 3416

I am using nightmare for testing.After running npm audit I get a warning about lodash Prototype pollution.I tried to fix this by running npm audit fix but no result.After that I tried using --force but still get :

fixed 0 of 1 vulnerability in 2108 scanned packages
  1 vulnerability required manual review and could not be updated

Any ideas how can I fix it?

Here is a screenshot: enter image description here

nightmare npm-audit lodash npm
1 Answers

npm dependencies do not automatically get upgraded to a higher major version. So if package A depends on package B with a version specification such as:

// A/package.js
dependencies: {
  "B": "^2.1.3"
}

Then npm will keep B up to date for any version 2.x.y where x >= 1 and (y >= 3 if x == 1 or y >= 0 if x > 1).

However, if the security fix happened in B version 3.v.w, then the security issue is going to remain in your npm repository.

The problem here is that to be able to use version 3.v.w you may have to update A because it is likely that there are breaking changes between 2 and 3 (i.e. a function name changed or support for a certain property was removed.)

Here is an example of breaking changes in the react-idle-timer module:

Migration from v3 to v4

There are a few breaking changes in version 4:

  • Although still capable of rendering children, as of version 4 we don't pass children to IdleTimer. Unless you are really good with shouldComponentUpdate you should avoid using IdleTimer as a wrapper component.
  • The property startOnLoad has been renamed to startOnMount in order to make more sense in a React context.
  • The property activeAction has been renamed to onActive.
  • The property idleAction has been renamed to onIdle.
user_2123780
Related