How to fix npm audit fix issues?

The name of the pictureThe name of the pictureThe name of the pictureClash Royale CLAN TAG#URR8PPP



How to fix npm audit fix issues?



enter image description here



This shows up when I try to npm install, and all of them required manual review. I've tried to visit this to check for more info and apparently it's because my lodash is of version 4.17.4. So I've then run npm install --save lodash@4.17.5 and checked my package.json to make sure it's reflecting correctly.


npm install


lodash


4.17.4


npm install --save lodash@4.17.5


package.json



However, it seems the vulnerabilities is still there. Wondering if I fix it the wrong way?



As per requested, the body of package.json


"dependencies":
"lodash": "^4.17.5",





in your package.json what do you have for lodash in dependencies? Post the actual string in the question body please.
– Akrion
Aug 8 at 16:52



package.json


lodash





@Akrion: Yes it does have
– Isaac
Aug 9 at 2:10





Wait ... it talks about the react-native-cached-image that lib has that issue since it probably has dependency on that older version of lodash no? Can you see in that lib what does it say in its package.json?
– Akrion
Aug 9 at 2:12



react-native-cached-image


package.json





Yep in that lib you have 4.17.4 just checked in their github @ github.com/kfiroo/react-native-cached-image/blob/master/…
– Akrion
Aug 9 at 2:14



4.17.4




1 Answer
1



Issue is related to the react-native-cached-image package having a dependency on lodash 4.17.4 as you can see here: https://github.com/kfiroo/react-native-cached-image/blob/master/package.json#L51


react-native-cached-image


4.17.4





In that case I can only wait until the package owner to update the dependency on their own? Or for the local version I can work something about it?
– Isaac
Aug 9 at 2:22





Possible to navigate into the node_module and doing an npm update on this package?
– Isaac
Aug 9 at 2:23





Their latest version is v1.4.3. If you are on that version then you can either wait (and maybe open an issue on their repo to address this) or you could also fork their repo and make the change yourself. See if that fixes it. This way at least you know for sure what is the problem and what the solution.
– Akrion
Aug 9 at 2:25


v1.4.3


fork





If you fork and change it ... if there are no side-effects/bugs you can push a PR and see if they accept it etc.
– Akrion
Aug 9 at 2:26





Any luck? Ware you able to prove that changing the lodash version in that package fixes the issue?
– Akrion
Aug 9 at 16:07






By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

-

Popular posts from this blog

Firebase Auth - with Email and Password - Check user already registered

Image
Clash Royale CLAN TAG #URR8PPP Firebase Auth - with Email and Password - Check user already registered I want to check when a user attempts to signup with createUserWithEmailAndPassword() in Firebase user Authentication method, this user is already registered with my app. createUserWithEmailAndPassword() 8 Answers 8 To detect whether a user with that email address already exists, you can detect when the call to createUserWithEmailAndPassword () fails with auth/email-already-in-use . I see that @Srinivasan just posted an answer for this. createUserWithEmailAndPassword () auth/email-already-in-use Alternatively, you can detect that an email address is already used by calling fetchSignInMethodsForEmail() (previous called fetchProvidersForEmail() ). fetchSignInMethodsForEmail() fetchProvidersForEmail() When the user trying to create an user with same email address, the task response will be "Response: The email address is already in use by another account." mFirebas...
Read more

Dynamically update html content plain JS

Image
Clash Royale CLAN TAG #URR8PPP Dynamically update html content plain JS So I have a script bound in my index.html, which literally has to fetch an array of jsons from an api, then dynamically update my page when get response. But as a result I'm getting an as the only update of my page. here is my script fetch(url) .then((resp) => resp.json()) .then((resp) => resp.results.forEach(item => fetch(item.url) .then((response)=> response.json()) .then((response) => pokeArr.push(response)) .catch(console.log) ) ).catch(console.log) const filler = () => if(!pokeArr) return 0 pokeArr.map((i,j)=> return `<tr>$i.name</tr>` ) const pokeindex = () => document.getElementById('a').appendChild(document.createElement(filler())) pokeindex() When I'm consoling it, I can see in the console all the responses I get, so I'm at least doing the fetching part right. What's parberakan ? What's pokeArr ? – T.J. Crowder Aug 8 at 12...
Read more

Creating a leaderboard in HTML/JS

Image
Clash Royale CLAN TAG #URR8PPP Creating a leaderboard in HTML/JS I'm trying to create a top 10 leaderboard, for now, I've only implemented 3 players, but I'm coming across an issue. My script doesn't seem to be outputting anything on webpage. The purpose of the script is to compare 3 arrays, player1,player2,and player3 solely based off of score. Which is the 2nd index of each array. I want the script to list the players in order of highest score. This method doesn't really seem to be efficient, especially when I'll have to add 7 more players. Could someone suggest perhaps an easier approach, as well as show me why my script wont output the info. Here's the JS function leaderboard() { var player1 = name:"Thomas",date:"01/23/18",score:"201"; var player2 = name:"Michael",date:"03/24/17",score:"943"; var player3 = Name:"Lisa",date:"06/04/18",Score:"79"; if(player1[2]...
Read more