I have a problem with a ViteJS project, I have 7 moderate vulnerabilities with Semver:
# npm audit report
semver <7.5.2
Severity: moderate
semver vulnerable to Regular Expression Denial of Service - https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
No fix available
node_modules/@babel/core/node_modules/semver
node_modules/@babel/helper-compilation-targets/node_modules/semver
node_modules/eslint-plugin-import/node_modules/semver
node_modules/eslint-plugin-jsx-a11y/node_modules/semver
node_modules/eslint-plugin-react/node_modules/semver
@babel/core *
Depends on vulnerable versions of @babel/helper-compilation-targets
Depends on vulnerable versions of semver
node_modules/@babel/core
@babel/helper-compilation-targets *
Depends on vulnerable versions of @babel/core
Depends on vulnerable versions of semver
node_modules/@babel/helper-compilation-targets
@vitejs/plugin-react *
Depends on vulnerable versions of @babel/core
node_modules/@vitejs/plugin-react
eslint-plugin-import >=2.27.4
Depends on vulnerable versions of semver
node_modules/eslint-plugin-import
eslint-plugin-jsx-a11y >=6.6.0
Depends on vulnerable versions of semver
node_modules/eslint-plugin-jsx-a11y
eslint-plugin-react 7.19.0 || >=7.26.0
Depends on vulnerable versions of semver
node_modules/eslint-plugin-react
7 moderate severity vulnerabilities
To address issues that do not require attention, run:
npm audit fix
To address all issues possible (including breaking changes), run:
npm audit fix --force
Some issues need review, and may require choosing
a different dependency.
I tried to add:
"resolutions": {
"semver": "^7.5.3"
}
On my package.json to delete the node_modules and the package-lock.json but nothing to do it does not work, do you have an idea?
Is it possible to update shared dependencies to use the latest version of Semver?
