When I run npm install it says found 10 vulnerabilities (10 low)
run npm audit fix to fix them, or npm audit for details.
However, npm audit fix outputs up to date in 11s fixed 0 of 10 vulnerabilities in 24653 scanned packages 10 vulnerabilities required manual review and could not be updated
Does that review mean it is not supposed to be fixed by user?
When I run npm audit it gives me list of tables, similar to this:
=== npm audit security report ===
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node-fetch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=2.6.1 <3.0.0-beta.1|| >= 3.0.0-beta.9 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ expo │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ expo > expo-constants > fbjs > isomorphic-fetch > node-fetch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1556 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node-fetch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=2.6.1 <3.0.0-beta.1|| >= 3.0.0-beta.9 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ expo │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ expo > expo-linking > expo-constants > fbjs > │
│ │ isomorphic-fetch > node-fetch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1556 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ Low │ Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ node-fetch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=2.6.1 <3.0.0-beta.1|| >= 3.0.0-beta.9 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ expo │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ expo > expo-error-recovery > fbjs > isomorphic-fetch > │
│ │ node-fetch │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/1556 │
└───────────────┴──────────────────────────────────────────────────────────────┘
found 10 low severity vulnerabilities in 1062 scanned packages
10 vulnerabilities require manual review. See the full report for details.
chingun@Chinguns-MacBook-Pro rn-starter % npm install <node-fetch>@3.0.0-beta.9
zsh: no such file or directory: node-fetch
chingun@Chinguns-MacBook-Pro rn-starter % npm install node-fetch@3.0.0-beta.9
npm WARN fetch-blob@2.1.1 requires a peer of domexception@^2.0.1 but none is installed. You must install peer dependencies yourself.
+ node-fetch@3.0.0-beta.9
updated 1 package and audited 1062 packages in 4.161s
55 packages are looking for funding
run `npm fund` for details
found 10 low severity vulnerabilities
run `npm audit fix` to fix them, or `npm audit` for details
chingun@Chinguns-MacBook-Pro rn-starter % npm install node-fetch 3.0.0-beta.9
npm ERR! code E404
npm ERR! 404 Not Found - GET https://registry.npmjs.org/3.0.0-beta.9 - Not found
npm ERR! 404
npm ERR! 404 '3.0.0-beta.9@latest' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.
npm ERR! A complete log of this run can be found in:
npm ERR! /Users/chingun/.npm/_logs/2021-01-18T09_03_23_637Z-debug.log
chingun@Chinguns-MacBook-Pro rn-starter % npm install node-fetch 2.6.1
npm ERR! code E404
npm ERR! 404 Not Found - GET https://registry.npmjs.org/2.6.1 - Not found
npm ERR! 404
npm ERR! 404 '2.6.1@latest' is not in the npm registry.
npm ERR! 404 You should bug the author to publish it (or use the name yourself!)
npm ERR! 404
npm ERR! 404 Note that you can also install from a
npm ERR! 404 tarball, folder, http url, or git url.
npm ERR! A complete log of this run can be found in:
npm ERR! /Users/chingun/.npm/_logs/2021-01-18T09_04_02_408Z-debug.log
chingun@Chinguns-MacBook-Pro rn-starter % npm install node-fetch@3.0.0-beta.9
npm WARN fetch-blob@2.1.1 requires a peer of domexception@^2.0.1 but none is installed. You must install peer dependencies yourself.
+ node-fetch@3.0.0-beta.9
updated 1 package and audited 1062 packages in 4.161s
55 packages are looking for funding
run `npm fund` for details
found 10 low severity vulnerabilities
run `npm audit fix` to fix them, or `npm audit` for details
chingun@Chinguns-MacBook-Pro rn-starter % npm audit fix
⸨ ░░░░░░░░░░░░░░░░⸩ ⠧ loadDep:whatwg-fetch: sill install loadAllDepsIntoIdealTrnpm WARN fetch-blob@2.1.1 requires a peer of domexception@^2.0.1 but none is installed. You must install peer dependencies yourself.
up to date in 3.454s
55 packages are looking for funding
run `npm fund` for details
fixed 0 of 10 vulnerabilities in 1062 scanned packages
10 vulnerabilities required manual review and could not be updated
chingun@Chinguns-MacBook-Pro rn-starter %