There are critical vulnerabilities in preact-cli, and trying to run npm audit fix leads to a never-ending loop between versions 3.0.5 and 2.2.1

Currently in the process of setting up a preact project using preact-cli:

npx --version # 7.4.0
npx preact-cli create typescript frontend

Upon completion, the following information is provided:

...
added 1947 packages, and audited 1948 packages in 31s

129 packages are looking for funding
  run `npm fund` for details

3 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.
✔ Done!

After just completing the default setup, it's alarming to discover 3 high security vulnerabilities.

npm audit fix

...
fix available via `npm audit fix --force`
Will install <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="fd8d8f989c9e89d09e9194bdcfd3cfd3cc">[email protected]</a>, which is a breaking change

Deciding to proceed with npm fix initiates a downgrade of preact-cli. Let's proceed accordingly:

npm audit fix --force

...

fix available via `npm audit fix --force`
Will install <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="740406111517005917181d34475a445a41">[email protected]</a>, which is a breaking change
node_modules/preact-cli/node_modules/webpack-dev-server/node_modules/yargs-parser
node_modules/preact-cli/node_modules/yargs-parser
  yargs  4.0.0-alpha1 - 12.0.5 || 14.1.0 || 15.0.0 - 15.2.0
  Depends on vulnerable versions of os-locale
  Depends on vulnerable versions of yargs-parser
  node_modules/preact-cli/node_modules/webpack-dev-server/node_modules/yargs
  node_modules/preact-cli/node_modules/yargs
    preact-cli  1.0.0 - 3.0.0-next.3
    Depends on vulnerable versions of extract-text-webpack-plugin
    Depends on vulnerable versions of url-loader
    Depends on vulnerable versions of yargs
    node_modules/preact-cli
    webpack  2.1.0-beta.8 - 4.0.0-alpha.0
    Depends on vulnerable versions of yargs
    node_modules/preact-cli/node_modules/webpack
      extract-text-webpack-plugin  2.0.0-beta.0 - 3.0.2
      Depends on vulnerable versions of webpack
      node_modules/preact-cli/node_modules/extract-text-webpack-plugin
      webpack-dev-server  2.0.0-beta - 3.10.3
      Depends on vulnerable versions of webpack
      Depends on vulnerable versions of yargs
      node_modules/preact-cli/node_modules/webpack-dev-server

17 vulnerabilities (7 low, 8 moderate, 2 high)

The attempt to downgrade to version 2.2.1 leads to new vulnerabilities surfacing. Reverting back to version 3.0.5 seems to resolve these issues.

This sets off a cycle as npm audit fix --force switches between versions 3.0.5 and 2.2.1 of preact-cli.

A bit of background: This appears to be a documented problem.

javascripttypescriptnpmpreactpreact-cli

Answer №1

Although it's late (the CLI repo is already closed), it's worth mentioning that version 2.2.1 is now a few years old and the dependency in question was only for build time purposes. There is no real risk associated with build time dependencies, especially this particular one, as its main function was to report changes in the final bundle size.

When dealing with issues raised by npm audit, always make sure to assess what it actually pertains to. If it relates strictly to build-time elements, you can typically disregard them without any major concern.

Similar questions

If you have not found the answer to your question or you are interested in this topic, then look at other similar questions below or use the search

Is it possible to have a single listener for all events within the jQuery event namespace?

Is it possible to create a handler that can listen to ALL events within a specific namespace in jQuery using $.fn.on, off, and trigger functions? For example: $(window).on(".event_namespace", function(e){ //handler }); $(window).trigger("testEvent.e ...

javascriptjqueryevents

Need assistance with debugging the current solution for the todo App using Commander or considering a different approach with Readline and Event Emitter?

I'm currently working on developing a CLI for a Node.js exclusive todo application using the commander and conf modules within Node.js, along with chalk to add color to the output. I've encountered some issues that I'm unsure how to resolve: ...

javascriptnode.jscommand-line-interfacereadlinenode-commander

Having trouble with Google Maps Places API autocomplete feature; it's not functioning properly

My goal is to integrate the Google Maps Places API with a search box. To test jQuery autocomplete, I managed to make it work using this simple example: function bindAutocomplete() { var locationSearch = $("input#Location"); locationSearch.autocom ...

javascriptjqueryajaxgoogle-mapsautocomplete

Creating custom components that encapsulate the functionality of Angular Material tabs component

I am aiming to incorporate the Angular Material tabs component within my shared components. Here is the component I'm attempting to wrap: Note: Each tab can display a component: <mat-tab-group> <mat-tab label="First"> Content ...

angulartypescriptangular-materialfrontendng-content

What are some effective methods for selectively handling batches of 5-20k document inputs when adding them to a collection containing up to one million documents using MongoDB and Mongoose?

My MMO census and character stats tracking application receives input batches containing up to 5-20k documents per user, which need to be aggregated into the database. I have specific criteria to determine whether a document from the input already exists i ...

javascriptnode.jsmongodbmongoosebigdata

"Exploring the realms of AngularJS through callback functions and variable scopes

I am currently experiencing an issue with JavaScript in general. Specifically, I am trying to update a list after invoking a callback from two separate files. Here is the description of the callback : this.modify = function(){ var self = this; v ...

javascriptangularjscallback

Error: Trying to access a property that is not declared on an empty object

Using a fully patched Visual Studio 2013, I am integrating JQuery, JQueryUI, JSRender, and TypeScript into my project. However, I am encountering an error in the ts file: Property 'fadeDiv' does not exist on type '{}'. While I believ ...

typescript

Analyzing a string using an alternative character

I want to convert the string "451:45" into a proper number. The desired output is 451.45. Any help would be appreciated! ...

angulartypescript

How can I ensure that Chakra UI MenuList items are always visible on the screen?

Currently, I am utilizing Chakra UI to design a menu and here is what I have so far: <Menu> <MenuButton>hover over this</MenuButton> <MenuList> <Flex>To show/hide this</Flex> </MenuList> </ ...

javascriptcssreactjsnext.jschakra-ui

Unable to automate the selection of a dropdown menu using Selenium WebDriver

I am currently utilizing http://www.makemytrip.com/ This is the HTML code. <div class="mrgnBot30 clearFix"> <span class="watch_icn flL"></span> <div class="widget_inner clearFix suggest_me padBot15 flL"> <h3 class="clearFix has ...

javascripthtmldrop-down-menuwebdriverselenium-webdriver

Getting the ajax response by utilizing a custom attribute within a php loop is definitely a handy trick

Currently working on integrating ajax with php. I have a set of buttons within a loop, and I am trying to display or fetch data (number) in the correct place/div using the "attr" method in jQuery. However, it seems that it is not functioning as expected on ...

javascriptphpjqueryajax

What specific element is being targeted when a directive injects a ViewContainerRef?

What specific element is associated with a ViewContainerRef when injected into a directive? Take this scenario, where we have the following template: template `<div><span vcdirective></span></div>` Now, if the constructor for the ...

htmlangulartypescript

Make sure to always select the alternative option in ajax

I am trying to create a condition where if the value of id=type_investor is either 1 or 6, an email should be sent using a different controller. Here is my complete code: function (isConfirm) { if (!isConfirm) return; $.ajax({ ...

javascriptjqueryajax

In Next.js, the elements inside the div created by glider-js are not properly loaded

I'm currently working on setting up a carousel in nextjs using the data retrieved from an API and utilizing glider-js for this purpose. However, I'm facing an issue where the div created by glinder-js does not include the elements that are render ...

javascriptreactjsnext.js

query the database to retrieve information from a dropdown menu that shows connected services using the CodeIgniter framework

I am currently utilizing both Codeigniter and bootstrap in my project. Within my project, I have two select options named "service" and "sub-service". The values for these options are stored within an array. Here is a visual representation of the options: ...

javascriptphpcodeigniterbootstrap-4codeigniter-3

npm: generate new script directive

When I start up my NodeJs (ES6) project, I usually enter the following command in the console: ./node_modules/babel/bin/babel-node.js index.js However, I wanted to streamline this process by adding the command to the scripts section of my package.json fi ...

javascriptnode.jsnpm

Oops! The last loader did not provide a Buffer or String as expected

After converting my GraphQL query and HOC component to typescript, I encountered the following error: ERROR in ./client/components/Protected.Route.tsx Module build failed: Error: Final loader (./node_modules/awesome-typescript-loader/dist/entry.js) didn ...

reactjstypescriptwebpackgraphqlawesome-typescript-loader

What is the best way to detect component errors on the server with Angular Universal?

Here is a snippet of my server code that renders the Angular home.component: app.get("*", (req, res) => { res.render( `../${CLIENT_DIST_DIR}/index`, { req: req, res: res, providers: [ ...

javascriptnode.jsangularangular-universalserver-side-rendering

In the path of Artifactory's scoped npm packages, an additional "scope" is included

I recently released a scoped npm package in an npm-local repository on Artifactory. For instance, let's say the package is named @scope/packagename in the package.json file. However, I noticed that the path it generates on Artifactory includes an extr ...

node.jsnpmartifactory

Regex fails to recognize repeated instances of a specific pattern

Currently, my goal is to create a JavaScript regex that can interpret instances of patterns like \123 and convert them into their corresponding ASCII values. For example, 65 should be replaced with A. If the backslash \ itself needs to be includ ...

javascriptregex