[but] npm audit fix downgrades with pre-1.0.0 semver

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

# npm audit report

glob-parent  <5.1.2
Severity: moderate
Regular expression denial of service - https://npmjs.com/advisories/1751
fix available via `npm audit fix --force`
Will install htmlhint@0.9.9, which is a breaking change
node_modules/glob-base/node_modules/glob-parent
  glob-base  *
  Depends on vulnerable versions of glob-parent
  node_modules/glob-base
    parse-glob  >=2.1.0
    Depends on vulnerable versions of glob-base
    node_modules/parse-glob
      htmlhint  >=0.9.10
      Depends on vulnerable versions of parse-glob
      node_modules/htmlhint

4 moderate severity vulnerabilities

after audit fix --force I get 6 high severity vulnerabilities instead of the original 4 moderate... so much for fix...

Expected Behavior

No downgrade

Steps To Reproduce

htmlhint": "^0.15.1

run npm audit

Environment

• OS: win10
• Node: v14.17.3
• npm: 7.20.5

Start by reproducing the report with htmlhint ^0.15.1 on Node v14.17.3 and npm 7.20.5, then run npm audit followed by npm audit fix --force. Compare the resulting dependency versions and vulnerability counts. Done means the forced fix does not downgrade htmlhint or increase the reported vulnerabilities.