Force npm to update dependency

user_8867591 0
Viewed 2985

In my project, I use "laravel-mix", which depends on "webpack-dev-server"

"npm audit" reports a high severity vulnerability on my version webpack-dev-server so I've been trying to update it to the latest version.. but with no success.

I've tried

npm update
npm update webpack-dev-server
npm update laravel-mix

with no success.. I guess the issue is that laravel-mix is already up-to-date, yet its dependency is not..

I've tried to add as a dependency a later version of webpack-dev-server hoping it would replace the old one, but instead, I just the two versions co-existing:

npm ls webpack-dev-server
+-- laravel-mix@2.1.14
| `-- webpack-dev-server@2.11.3
`-- webpack-dev-server@3.1.10

Is there a way for me to force the update of the webpack-dev-server dependency? I need laravel-mix for this project, and as my assets are compiled on the production server, I can't even set it as a dev-only dependency..

npm webpack
2 Answers

Unfortunately if the package you're using has pinned its own dependency there is no way of fixing it at the top level of your project, although this is a planned future feature of npm to allow aliasing to override sub-dependencies.

You can see a short guide here to manually review sub-dependencies and creating a PR to the project to get their own dependency fixed.

In future, might I also suggest using npm audit fix if it's available on the version you're using as this will attempt to automatically fix issues if it can.

As an aside I wouldn't worry too much about this vulnerable package, although it is a high severity it would only be an issue if you were using the dev-server in production, which as it says dev on the tin, you definitely shouldn't be using it anywhere but locally in dev. :-)

Wesley_22282020

We had a simillar issue with puppeteer > extract-zip > mkdirp > minimist, where minimist had a security vulnerability. It was upgraded and so was mkdirp , but extract-zip isn't at the time of this writting.

Using npx npm-force-resolutions under the scripts entry in package.json seems to have done the trick. 

$ git diff package.json 
diff --git a/package.json b/package.json
index cf825cf..0d694b3 100644
--- a/package.json
+++ b/package.json
@@ -8,8 +8,13 @@
     "lib": "lib" 
   },
   "scripts": {
+    "preinstall": "npx npm-force-resolutions",
     "test": "echo \"Error: no test specified\" && exit 1" 
   },
+  "resolutions": {
+    "minimist": "1.2.3",
+    "mkdir": "0.5.3" 
+  },

Then running npm install: 

$ npm install && npm audit

> sge@1.0.0 preinstall /home/jlam/code/prjName
> npx npm-force-resolutions

npx : 5 installé(s) en 5.733s
added 1 package from 1 contributor, removed 1 package and audited 72 packages in 7.212s

[...]

found 0 vulnerabilities

[...]    

                       === npm audit security report ===                        

found 0 vulnerabilities
 in 72 scanned packages
user_16119250
Related