How do I fix npm vulnerabilities that require semver-major dependency updates?

Question

I cloned ParaViewWeb from https://github.com/kitware/paraviewweb then did the following;-

$ npm install
$ npm audit fix

Leaving me with this:

found 42 vulnerabilities (9 low, 23 moderate, 10  high) in 41716 scanned packages
14 vulnerabilities require semver-major dependency updates.
28 vulnerabilities require manual review.

How do I fix the 14 vulnerabilities that require semver-major dependency updates?

score 6 · Answer 1 · answered Sep 11 '20 at 12:56

6

When you run npm audit, there should be a line telling you how to update it, e.g.:

# Run  npm install --save-dev example@5.0.2  to resolve 1 vulnerability
# SEMVER WARNING: Recommended action is a potentially breaking change

Just execute that to fix it.

answered Sep 11 '20 at 12:56

vauhochzett

2,732
2
17
40

1

Only works if there is a current fix though. – ZStoneDPM Dec 07 '20 at 12:22
"Just execute that" is correct, but not right -> one should test whether the changes are actually breaking anything. – A-Tech Dec 12 '22 at 16:18
Of course, but you can add that advice to most answers on StackOverflow... e.g. the other ones here. Should be obvious in my opinion. – vauhochzett Dec 19 '22 at 19:39

score 3 · Answer 2 · answered Feb 23 '21 at 12:21

3

If you are already sure that you need to run all that updates then use:

npm audit fix --force

From npm Docs

If the chain of metavulnerabilities extends all the way to the root project, and it cannot be updated without changing its dependency ranges, then npm audit fix will require the --force option to apply the remediation. If remediations do not require changes to the dependency ranges, then all vulnerable packages will be updated to a version that does not have an advisory or metavulnerability posted against it.

answered Feb 23 '21 at 12:21

Nahue Gonzalez

273
4
10

should we run it with `sudo` – alper Oct 17 '21 at 14:28
if you can use other npm command without sudo then no. – A-Tech Dec 13 '22 at 08:28

score 1 · Answer 3 · answered Dec 07 '20 at 12:21

If you are in my situation, there currently is no fix.

You may have to complete the fix yourself: Go into the package and change it's package.json version manually.

OR

Open an issue on the package and hope its still being maintained by the creator.

https://docs.npmjs.com/auditing-package-dependencies-for-security-vulnerabilities

has a list of suggested fixes.

score 0 · Answer 4 · answered Dec 04 '20 at 02:03

0

Upgrade npm through this command

npm install npm@latest -g

answered Dec 04 '20 at 02:03

Two

512
4
17

How do I fix npm vulnerabilities that require semver-major dependency updates?

4 Answers4