Parcel-Bundler cannot fix high vulnerabilities

user_14692585 0
Viewed 841

I followed Kevin Powell's YT video on SASS and Parcel. I manage to get the SASS part up and running fine and managed to get the parcel-bundler working on one project fine...so up to that point everything is ok.

Today I was creating a new project and followed all the required steps and when I got to installing Parcel via npm install parcel-bundler --save-dev I'm getting 2 high severity vulnerabilities....I've ran the npm audit fix command and the npm audit fix --force as suggested but no luck on getting rid of the issue.

Here's the output of the npm audit

npm audit report

node-forge  <=0.9.2
Severity: high
Prototype Pollution in node-forge - https://npmjs.com/advisories/1561
fix available via `npm audit fix --force`
Will install parcel-bundler@1.3.1, which is a breaking change
node_modules/node-forge
  parcel-bundler  >=1.4.0
  Depends on vulnerable versions of node-forge
  node_modules/parcel-bundler

2 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

I have tried all possible solutions that I could find on the issue, but for the life of me I can't get it to work.

I even did a test on both my PC and Laptop...my main PC is running Linux Mint 19.2 cinnamon and the laptop Window 10 and in both I get the same 2 vulnerabilities.

How can I fix this?

npm bundler javascript
3 Answers

I had same issue this days. I tried everything possible, and only this worked

npm add --dev parcel@next

or

npm add --include=dev parcel@next

If they don't work try also with:

npm install -D parcel@next

Its version 2.0.0-beta.1

Also, I uninstall NodeJS, deleted users/{myName}/AppData/Roaming/npm directories, package.json, and node_modules.

user_75045060

Thanks @Stefan!

To summarize the steps I took to make it work was:

Deleted all pre-existing .json, node_modules, cache folders and even the dist folder intended to hold the bundled code (html, css, etc.) to make sure I had a clean slate to begin with.

Then I initialized npm:

npm init -y

After that I added 'Parcel':

npm add --include=dev parcel@next

I fixed any issues by forcing the fix and making sure there was no issues whatsoever:

npm audit fix --force

And now the sweet part...I just ran Yarn and voilá, it works!

yarn parcel index.html
  • npm version: 7.6.3
  • parcel version: 2.0.0-beta.1
  • yarn version: 1.22.5
user_146925850
user_86456960
Related