NPM audit warnings

Technically, there is no silver bullet to solve the vulnerabilities report from npm audit. Here is the "Rule of Thumb" I am following:

• Usually, I always do npm audit fix after npm audit. Note that: this one will not solve all reports.

• Update my dependencies to the latest stable. Be careful about the compatibility. (Hope you understand the SEMVER). The cost you spend to keep your system up to date and stable is always cheaper than the cost you need to spend to handle vulnerable issues.

• Reduce the number of your dependencies. Note everything you need to use the library. You can build yourself a simpler version.

• Learn to separate dependencies and dev dependencies. If the issue is reported for a dev tool, you can skip it. As I said above, there is no silver bullet so give yourself relaxation instead of fixing all of them. Just fix the necessary ones.

• Finally, follow this: https://docs.npmjs.com/auditing-package-dependencies-for-security-vulnerabilities

You can make your dependencies to use other (current / secure) version of their dependencies.

Let's say you have a warning about postcss package, which I solved a moment ago so I can describe the process and you can proceed analogically.

After npm audit I got a warning like:

  Moderate        Regular Expression Denial of Service                          
  Package         postcss                                                       
  Patched in      >=8.2.10                                                      
  Dependency of   laravel-mix [dev]                                             
  Path            laravel-mix > cssnano > cssnano-preset-default >              
                  postcss-svgo > postcss                                        
  More info       https://npmjs.com/advisories/1693  

Notice! You have to be aware that when you'll make your package to use a newer version of its dependency it can break things, but it's worth trying.

So you see that the laravel-mix package uses old version of the postcss and that the issue is fixed in version >=8.2.10 of postcss so you want to install a newer version of the postcss package which you can achieve by:

npm install postcss --save-dev

Then you need to add a new section to your package.json file instructing npm that you want dependencies to use your specific version of the library. It goes in my case like this:

{
  "resolutions": {
    "postcss": "^8.2.15",
  }
}

Then you have to add a new script to force npm usage of this new "resolutions" section like this:

"scripts": {
  "preinstall": "npx npm-force-resolutions"
}

Notice! You have to run this script every time before running your regular npm install. It goes like this:

npm run preinstall
npm install

More info can be found in the npm docs.

You might just need to edit your package.json, update the version for the offending package to the latest stable version (in this case https://www.npmjs.com/package/node-fetch), and then run "npm install" from the terminal.