Ionic - found 50 vulnerabilities on npm install

user_3628010 0
Viewed 344

After creating a new Ionic Angular project, when I run npm install, the command completes with the following message:

up to date, audited 1795 packages in 4s

158 packages are looking for funding
  run `npm fund` for details

50 vulnerabilities (2 low, 43 moderate, 5 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

Ionic version: 6.18.1

npm update does not fix vulnerabilities. Subsequent npm audit fix finishes with the same message. Nothing seems to fix the vulnerabilities. Is there some issue in the latest release vulnerabilities, any fix/workaround available?

npm ionic-framework angular
1 Answers

NPM is a package management system. And many of the packages then have dependencies themselves.

npm audit fix will, as the message say, address non-breaking changes.

You can force the issue....but this will break things.

The most straight-forward way to address this is using an NPM package called npm-check-update

https://www.npmjs.com/package/npm-check-updates

Once installed you can run ncu -u and it will auto update your package.json.

I would also suggest hard coding to specific libraries by removing ^ and ~ specifiers. Nothing more vexing than having an application stop working because a dependency has a minor update which introduces a breaking change without notice.

And finally, you'll likely have to spend time fixing the API and other breaking changes which are at the core of this upgrade issue.

But that is beyond the scope of this particular question.

user_7964460
Related