0

How do I sort out npm vulnerabilities dependent on another package. For example I am getting the below error where the package undici is dependent on the prismix package.

Thinks I have tried:

  1. Running npm audit fix
  2. Prismix is already updated to the latest version
Moderate        undici before v5.8.0 vulnerable to CRLF injection in request headers                                                    
Package         undici                                                        
Patched in      >=5.8.0
Dependency of   prismix
Path            prismix > @prisma/sdk > @prisma/engine-core > undici
More info       https://github.com/advisories/GHSA-3cvr-822r-rqcc
Teknoville
  • 459
  • 1
  • 7
  • 18

1 Answers1

1

The authors of prismix may not have updated their dependencies yet.

You might need to wait for their dependencies to be updated, or you could try installing the version 5.8.0 of undici nonetheless and cross your finger that they are compatible.

To specify a version:

npm install undici@5.8.0
Philippe Vermeulen
  • 33
  • 7