
npm audit
npm audit report
json5 <1.0.2 Severity: high Prototype Pollution in JSON5 via Parse Method - https://github.com/advisories/GHSA-9c47-m6qq-7p4h fix available via `npm audit fix --force` Will install [email protected], which is a breaking change node_modules/babel-preset-expo/node_modules/json5 find-babel-config <=1.2.0 Depends on vulnerable versions of json5 node_modules/babel-preset-expo/node_modules/find-babel-config babel-plugin-module-resolver 2.3.0 - 4.1.0 Depends on vulnerable versions of find-babel-config node_modules/babel-preset-expo/node_modules/babel-plugin-module-resolver babel-preset-expo * Depends on vulnerable versions of babel-plugin-module-resolver node_modules/babel-preset-expo expo >=14.0.0 Depends on vulnerable versions of babel-preset-expo node_modules/expo 5 high severity vulnerabilities To address all issues (including breaking changes), run: npm audit fix --force
├─┬ @babel/[email protected] │ └── [email protected] deduped ├─┬ @expo/[email protected] extraneous │ └── [email protected] extraneous ├─┬ [email protected] invalid: "5.0.0" from the root project │ └─┬ [email protected] │ └── [email protected] ├─┬ [email protected] extraneous │ └─┬ @expo/[email protected] │ └─┬ @expo/[email protected] │ └── [email protected] ├─┬ [email protected] │ ├─┬ @expo/[email protected] │ │ ├─┬ @expo/[email protected] │ │ │ └── [email protected] │ │ ├─┬ @expo/[email protected] │ │ │ └─┬ @expo/[email protected] │ │ │ └── [email protected] │ │ └─┬ @expo/[email protected] │ │ └─┬ @expo/[email protected] │ │ └── [email protected] │ ├─┬ @expo/[email protected] │ │ └─┬ @expo/[email protected] │ │ └── [email protected] │ ├─┬ [email protected] │ │ └─┬ [email protected] │ │ └─┬ [email protected] │ │ └── [email protected] │ └─┬ [email protected] │ └─┬ @expo/[email protected] │ └─┬ @expo/[email protected] │ └── [email protected] ├─┬ [email protected] │ └── [email protected] deduped ├── [email protected] └─┬ [email protected] extraneous └── [email protected] deduped
"npm audit fix --force" or npm install --save json5@latest command is not working as expected.
32 Answers
package-lock.json
and find:"node_modules/find-babel-config": { "version": "1.2.0", "resolved": "...", "integrity": "...", "dependencies": { "json5": "^0.5.1", // Here is the problem "path-exists": "^3.0.0" }, "engines": { "node": ">=4.0.0" } },
"json5": "^2.2.3"
and run npm install
This solve the problem but still the npm audit will show high severity report
To fix that find and change this:
"node_modules/find-babel-config/node_modules/json5": { "version": "0.5.1", "resolved": "https://registry.npmjs.org/json5/-/json5-0.5.1.tgz", }
To:
"node_modules/find-babel-config/node_modules/json5": { "version": "^2.2.3", "resolved": "https://registry.npmjs.org/json5/-/json5-2.2.3.tgz", }
Then run npm i
resolved issues by updating the dependencies in the package-lock.json file, not user if this is the best scenario. I followed the steps on this website: https://itnext.io/fixing-security-vulnerabilities-in-npm-dependencies-in-less-than-3-mins-a53af735261d
The issues looks like a false positive.
Check the version of the packages installed. You can either remove the dep
ncG1vNJzZmirpJawrLvVnqmfpJ%2Bse6S7zGiorp2jqbawutJobm5sZWh9cnyOnq%2Bpp12fwLC6lGagrKulmnq4tNhmoKxlnqW6bq3UnaCtZZaexW6yzquanmWepMFuvsSspqWumaO0bsDHnmSvrZyjsrOtwaKjoqyp