npm / npm/cli

[BUG] npm 7.6.0 audit fix --force recommends running npm audit fix --force (the same command) to fix issues.

Open
#2,798 7 comments 4 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Bug Priority 2 Release 7.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Current Behavior:

npm audit fix --force recommends running npm audit fix --force (the same command) to fix issues.

This obviously makes no sense. npm audit fix --force should itself fix the issues reported.

$ npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating evergreen-ui to 5.1.2,which is a SemVer major change.

added 2 packages, removed 4 packages, changed 5 packages, and audited 2749 packages in 7s

105 packages are looking for funding
  run `npm fund` for details

# npm audit report

node-fetch  <=2.6.0 || 3.0.0-beta.1 - 3.0.0-beta.8
Denial of Service - https://npmjs.com/advisories/1556
fix available via `npm audit fix --force`
Will install evergreen-ui@2.0.1, which is a breaking change
node_modules/glamor/node_modules/node-fetch
node_modules/react-event-listener/node_modules/node-fetch
  isomorphic-fetch  2.0.0 - 2.2.1
  Depends on vulnerable versions of node-fetch
  node_modules/glamor/node_modules/isomorphic-fetch
  node_modules/react-event-listener/node_modules/isomorphic-fetch
    fbjs  0.7.0 - 1.0.0
    Depends on vulnerable versions of isomorphic-fetch
    node_modules/glamor/node_modules/fbjs
    node_modules/react-event-listener/node_modules/fbjs
      glamor  >=2.17.10
      Depends on vulnerable versions of fbjs
      node_modules/glamor
        evergreen-ui  *
        Depends on vulnerable versions of glamor
        Depends on vulnerable versions of react-scrollbar-size
        node_modules/evergreen-ui
      react-event-listener  0.2.0 - 0.3.0 || 0.4.4 - 0.5.10
      Depends on vulnerable versions of fbjs
      node_modules/react-event-listener
        react-scrollbar-size  1.0.0 - 2.1.0
        Depends on vulnerable versions of react-event-listener
        node_modules/react-scrollbar-size

7 low severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force
Expected Behavior:

npm fix ---force should resolve the issues by updating dependencies.

Steps To Reproduce:

Detail above might be enough, but ifnot, LMK and I'll produce a redacted package.json

Environment:
  • OS: Ubuntu 20.04
  • Node: v14.15.1
  • npm: 7.6.0

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No source file or test is named. Reproduce the behavior with npm 7.6.0 using npm audit fix --force, then trace the audit fix flow that produces the recommendation; done means the command updates dependencies or reports a genuinely unresolved fix rather than recommending itself.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
cli, security, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.