1

npm version 6.0.1 Run npm audit As many projects we have some vulnerabilities in ours.

First thing the report suggests is: 

# Run  npm update fsevents --depth 4  to resolve 65 vulnerabilities

I did this for several times decrementing the number of the issues but this time doesn't work. Any idea why?

eKelvin
  • 921
  • 1
  • 9
  • 25

2 Answers2

0

You already have fsevents installed, the lock file has the outdated values. If you manually change them in your lock file your npm audits would look clean, the problem being when you run npm install again it won't matter and they will install it again. Make sure to check your node_modules and the version of the libraries being used are in fact the ones without any vulnerabilities

Byrd
  • 867
  • 3
  • 12
  • 24
0

It's a problem npm audit/update have with some optional packages like fsevents. if you clear all those packages inside package.lock or yarn.lock or if you don't care about the lock just remove the file and run npm install or yarn install again to have the updated inner packages

eKelvin
  • 921
  • 1
  • 9
  • 25