[BUG] npm 7.6.0 audit fix --force recommends running npm audit fix --force (the same command) to fix issues.
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Current Behavior:
npm audit fix --force recommends running npm audit fix --force (the same command) to fix issues.
This obviously makes no sense. npm audit fix --force should itself fix the issues reported.
$ npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating evergreen-ui to 5.1.2,which is a SemVer major change.
added 2 packages, removed 4 packages, changed 5 packages, and audited 2749 packages in 7s
105 packages are looking for funding
run `npm fund` for details
# npm audit report
node-fetch <=2.6.0 || 3.0.0-beta.1 - 3.0.0-beta.8
Denial of Service - https://npmjs.com/advisories/1556
fix available via `npm audit fix --force`
Will install evergreen-ui@2.0.1, which is a breaking change
node_modules/glamor/node_modules/node-fetch
node_modules/react-event-listener/node_modules/node-fetch
isomorphic-fetch 2.0.0 - 2.2.1
Depends on vulnerable versions of node-fetch
node_modules/glamor/node_modules/isomorphic-fetch
node_modules/react-event-listener/node_modules/isomorphic-fetch
fbjs 0.7.0 - 1.0.0
Depends on vulnerable versions of isomorphic-fetch
node_modules/glamor/node_modules/fbjs
node_modules/react-event-listener/node_modules/fbjs
glamor >=2.17.10
Depends on vulnerable versions of fbjs
node_modules/glamor
evergreen-ui *
Depends on vulnerable versions of glamor
Depends on vulnerable versions of react-scrollbar-size
node_modules/evergreen-ui
react-event-listener 0.2.0 - 0.3.0 || 0.4.4 - 0.5.10
Depends on vulnerable versions of fbjs
node_modules/react-event-listener
react-scrollbar-size 1.0.0 - 2.1.0
Depends on vulnerable versions of react-event-listener
node_modules/react-scrollbar-size
7 low severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
Expected Behavior:
npm fix ---force should resolve the issues by updating dependencies.
Steps To Reproduce:
Detail above might be enough, but ifnot, LMK and I'll produce a redacted package.json
Environment:
- OS: Ubuntu 20.04
- Node: v14.15.1
- npm: 7.6.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named. Reproduce the behavior with npm 7.6.0 using npm audit fix --force, then trace the audit fix flow that produces the recommendation; done means the command updates dependencies or reports a genuinely unresolved fix rather than recommending itself.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli, security, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100