I have a React application and I use Yarn to maintain packages. GitHub Dependabot was showing several vulnerabilities as shown below.
The packages that have these vulnerabilities where not available in package.json. So, I have used Resulutions to get rid of these vulnerabilities and it did.
{
"name": "ui",
"version": "0.1.0",
"private": true,
"dependencies": {
"acorn": "6.4.1",
"bootstrap": "^4.3.1",
"classnames": "^2.2.6",
"enzyme": "^3.10.0",
"enzyme-adapter-react-16": "^1.15.0",
"eslint": "^6.1.0",
"handlebars": "4.7.7",
"json-server": "^0.15.1",
"kind-of": "6.0.3",
"minimist": "1.2.2",
"moment": "^2.24.0",
"node-sass": "^4.12.0",
// More Packages here
},
"resolutions": {
"is-svg":"4.3.0",
"ansi-html":"0.0.8",
"react-dev-utils":"11.0.4",
"immer":"9.0.6",
"node-notifier":"8.0.1",
"node-forge":"1.3.0",
// More resolutions here
}
}
Now, although dependabot is not showing the vulnerabilities, when I launch the application, I get a ton of warnings (marked as errors) as shown here.
[ERROR] warning Resolution field "browserslist@4.16.5" is incompatible with requested version "browserslist@4.14.2"
[ERROR] warning Resolution field "immer@9.0.6" is incompatible with requested version "immer@8.0.1"
[ERROR] warning Resolution field "kind-of@6.0.3" is incompatible with requested version "kind-of@^3.0.2"
[ERROR] warning Resolution field "kind-of@6.0.3" is incompatible with requested version "kind-of@^3.2.0"
[ERROR] warning Resolution field "kind-of@6.0.3" is incompatible with requested version "kind-of@^5.0.0"
[ERROR] warning Resolution field "kind-of@6.0.3" is incompatible with requested version "kind-of@^3.0.2"
[ERROR] warning Resolution field "kind-of@6.0.3" is incompatible with requested version "kind-of@^3.0.2"
[ERROR] warning Resolution field "kind-of@6.0.3" is incompatible with requested version "kind-of@^3.0.2"
[ERROR] warning Resolution field "kind-of@6.0.3" is incompatible with requested version "kind-of@^4.0.0"
[ERROR] warning Resolution field "kind-of@6.0.3" is incompatible with requested version "kind-of@^3.0.3"
[ERROR] warning Resolution field "tar@4.4.18" is incompatible with requested version "tar@^6.1.2"
[ERROR] warning Resolution field "tar@4.4.18" is incompatible with requested version "tar@^6.0.2"
[ERROR] warning Resolution field "ansi-regex@5.0.1" is incompatible with requested version "ansi-regex@^4.1.0"
[ERROR] warning Resolution field "ansi-regex@5.0.1" is incompatible with requested version "ansi-regex@^3.0.0"
[ERROR] warning Resolution field "trim-newlines@3.0.1" is incompatible with requested version "trim-newlines@^1.0.0"
[ERROR] warning Resolution field "tar@4.4.18" is incompatible with requested version "tar@^2.0.0"
[ERROR] warning Resolution field "ansi-regex@5.0.1" is incompatible with requested version "ansi-regex@^2.0.0"
[ERROR] warning Resolution field "ansi-regex@5.0.1" is incompatible with requested version "ansi-regex@^2.0.0"
[ERROR] warning Resolution field "react-dev-utils@11.0.4" is incompatible with requested version "react-dev-utils@^9.0.3"
[ERROR] warning Resolution field "postcss@7.0.36" is incompatible with requested version "postcss@7.0.14"
[ERROR] warning Resolution field "serialize-javascript@3.1.0" is incompatible with requested version "serialize-javascript@^1.7.0"
[ERROR] warning Resolution field "ansi-html@0.0.8" is incompatible with requested version "ansi-html@0.0.7"
[ERROR] warning Resolution field "object-path@0.11.8" is incompatible with requested version "object-path@0.11.4"
[ERROR] warning Resolution field "serialize-javascript@3.1.0" is incompatible with requested version "serialize-javascript@^4.0.0"
[ERROR] warning Resolution field "glob-parent@5.1.2" is incompatible with requested version "glob-parent@^3.1.0"
How do I get around this issue? Is there a better way to use than using resolutions?
Please let me know. Thanks in advance.