javascript - Npm 漏洞无法修复

Question

我开始学习 react 并通过运行创建了我的第一个应用程序:

'npx create-react-app my-app'

构建应用程序后，我在终端中收到一条警告，上面写着:

22 vulnerabilities (9 moderate, 13 high)

我试图通过运行来修复它:

'npm audit fix'

但它返回了这个:

npm ERR! code ERESOLVEnpm ERR! ERESOLVE unable to resolve dependency treenpm ERR!npm ERR! Found: type-fest@0.21.3npm ERR! node_modules/type-festnpm ERR! type-fest@"^0.21.3" from ansi-escapes@4.3.2npm ERR! node_modules/ansi-escapesnpm ERR! ansi-escapes@"^4.2.1" from @jest/core@26.6.3npm ERR! node_modules/@jest/corenpm ERR! @jest/core@"^26.6.0" from jest@26.6.0npm ERR! node_modules/jestnpm ERR! peer jest@"^26.0.0" from jest-watch-typeahead@0.6.1npm ERR! node_modules/jest-watch-typeaheadnpm ERR! 1 more (react-scripts)npm ERR! 1 more (jest-cli)npm ERR! ansi-escapes@"^4.3.1" from jest-watch-typeahead@0.6.1npm ERR! node_modules/jest-watch-typeaheadnpm ERR! jest-watch-typeahead@"0.6.1" from react-scripts@4.0.3npm ERR! node_modules/react-scriptsnpm ERR! react-scripts@"4.0.3" from the root projectnpm ERR! 2 more (jest-watcher, terminal-link)npm ERR!npm ERR! Could not resolve dependency:npm ERR! peerOptional type-fest@"^0.13.1" from @pmmmwh/react-refresh-webpack-plugin@0.4.3npm ERR! node_modules/@pmmmwh/react-refresh-webpack-pluginnpm ERR! @pmmmwh/react-refresh-webpack-plugin@"0.4.3" from react-scripts@4.0.3npm ERR! node_modules/react-scriptsnpm ERR! react-scripts@"4.0.3" from the root projectnpm ERR!npm ERR! Fix the upstream dependency conflict, or retrynpm ERR! this command with --force, or --legacy-peer-depsnpm ERR! to accept an incorrect (and potentially broken) dependency resolution.npm ERR!npm ERR! See /home/azizdragon/.npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in: npm ERR!
/home/azizdragon/.npm/_logs/2021-06-23T03_09_31_663Z-debug.log

我尝试删除 package-lock.json 文件和 node_modules 文件夹并运行:

npm install

但它导致了相同的漏洞，这是我运行“npm audit”时的报告:

browserslist 4.0.0 - 4.16.4Severity: moderateRegular Expression Denial of Service - https://npmjs.com/advisories/1747fix available via npm audit fix --forceWill install react-scripts@1.1.5, which is a breaking changenode_modules/react-dev-utils/node_modules/browserslistreact-dev-utils >=6.0.0-next.03604a46Depends on vulnerable versions of browserslistnode_modules/react-dev-utilsreact-scripts >=0.10.0-alpha.328cb32eDepends on vulnerable versions of @pmmmwh/react-refresh-webpack-pluginDepends on vulnerable versions of @svgr/webpackDepends on vulnerable versions of mini-css-extract-pluginDepends on vulnerable versions of react-dev-utilsDepends on vulnerable versions of webpack-dev-servernode_modules/react-scripts

css-what <5.0.1 Severity: high Denial of Service -https://npmjs.com/advisories/1754 fix available via npm audit fix --force Will install react-scripts@1.1.5, which is a breaking change node_modules/svgo/node_modules/css-what css-select <=3.1.2
Depends on vulnerable versions of css-what
node_modules/svgo/node_modules/css-selectsvgo >=1.0.0Depends on vulnerable versions of css-selectnode_modules/svgo@svgr/plugin-svgo *Depends on vulnerable versions of svgonode_modules/@svgr/plugin-svgo@svgr/webpack >=4.0.0Depends on vulnerable versions of @svgr/plugin-svgonode_modules/@svgr/webpackreact-scripts >=0.10.0-alpha.328cb32eDepends on vulnerable versions of @pmmmwh/react-refresh-webpack-pluginDepends on vulnerable versions of @svgr/webpackDepends on vulnerable versions of mini-css-extract-pluginDepends on vulnerable versions of react-dev-utilsDepends on vulnerable versions of webpack-dev-servernode_modules/react-scriptspostcss-svgo >=4.0.0-nightly.2020.1.9Depends on vulnerable versions of svgonode_modules/postcss-svgocssnano-preset-default *Depends on vulnerable versions of postcss-normalize-urlDepends on vulnerable versions of postcss-svgonode_modules/cssnano-preset-defaultcssnano 4.0.0-nightly.2020.1.9 - 4.1.11Depends on vulnerable versions of cssnano-preset-defaultnode_modules/cssnanooptimize-css-assets-webpack-plugin 3.2.1 || 5.0.0 - 5.0.4 || 5.0.6Depends on vulnerable versions of cssnanonode_modules/optimize-css-assets-webpack-plugin

glob-parent <5.1.2 Severity: moderate Regular expression denial ofservice - https://npmjs.com/advisories/1751 fix available via npm audit fix --force Will install react-scripts@1.1.5, which is abreaking changenode_modules/watchpack-chokidar2/node_modules/glob-parentnode_modules/webpack-dev-server/node_modules/glob-parent chokidar1.0.0-rc1 - 2.1.8 Depends on vulnerable versions of glob-parent node_modules/watchpack-chokidar2/node_modules/chokidar
node_modules/webpack-dev-server/node_modules/chokidarwatchpack-chokidar2 *Depends on vulnerable versions of chokidarnode_modules/watchpack-chokidar2watchpack 1.7.2 - 1.7.5Depends on vulnerable versions of watchpack-chokidar2node_modules/watchpackwebpack 4.44.0 - 4.46.0Depends on vulnerable versions of watchpacknode_modules/webpackwebpack-dev-server 2.0.0-beta - 3.11.2Depends on vulnerable versions of chokidarnode_modules/webpack-dev-server@pmmmwh/react-refresh-webpack-plugin 0.3.1 - 0.5.0-beta.4Depends on vulnerable versions of webpack-dev-servernode_modules/@pmmmwh/react-refresh-webpack-pluginreact-scripts >=0.10.0-alpha.328cb32eDepends on vulnerable versions of @pmmmwh/react-refresh-webpack-pluginDepends on vulnerable versions of @svgr/webpackDepends on vulnerable versions of mini-css-extract-pluginDepends on vulnerable versions of react-dev-utilsDepends on vulnerable versions of webpack-dev-servernode_modules/react-scripts

normalize-url <=4.5.0 || 5.0.0 - 5.3.0 || 6.0.0 Severity: highRegular Expression Denial of Service -https://npmjs.com/advisories/1755 fix available via npm audit fix --force Will install react-scripts@1.1.5, which is a breaking change node_modules/normalize-urlnode_modules/postcss-normalize-url/node_modules/normalize-url
mini-css-extract-plugin 0.6.0 - 1.0.0 Depends on vulnerableversions of normalize-url node_modules/mini-css-extract-pluginreact-scripts >=0.10.0-alpha.328cb32eDepends on vulnerable versions of @pmmmwh/react-refresh-webpack-pluginDepends on vulnerable versions of @svgr/webpackDepends on vulnerable versions of mini-css-extract-pluginDepends on vulnerable versions of react-dev-utilsDepends on vulnerable versions of webpack-dev-servernode_modules/react-scripts postcss-normalize-url <=4.0.1 Depends on vulnerable versions of normalize-url
node_modules/postcss-normalize-urlcssnano-preset-default *Depends on vulnerable versions of postcss-normalize-urlDepends on vulnerable versions of postcss-svgonode_modules/cssnano-preset-defaultcssnano 4.0.0-nightly.2020.1.9 - 4.1.11Depends on vulnerable versions of cssnano-preset-defaultnode_modules/cssnanooptimize-css-assets-webpack-plugin 3.2.1 || 5.0.0 - 5.0.4 || 5.0.6Depends on vulnerable versions of cssnanonode_modules/optimize-css-assets-webpack-plugin

22 vulnerabilities (9 moderate, 13 high)

To address issues that do not require attention, run: npm audit fix

To address all issues (including breaking changes), run: npm auditfix --force

我应该使用 npm audit fix --force 吗？
如果有帮助，我运行 Linux Mint 18.3 Cinnamon 64 位
Node 版本:v16.0.0
NPM 版本:7.18.1
提前致谢。

Answer 1

正如 Matthew Daly 在这篇博文 npm audit: Broken by Design 之后的评论中提到的那样作者:丹·阿布拉莫夫，大多数或可能所有警告都与开发依赖项有关，因此它们不会影响您的生产构建 ，并且您根本不必担心修复它们。
这并不意味着开发依赖项的漏洞在任何情况下、每个包和每个版本中都是无害的。
根据我的经验，大多数情况下使用 npm audit 无法解决所有问题。并且几乎总是使用 npm audit --force会使情况变得更糟并破坏您的应用程序。
因此，当我安装一个流行的、高度维护的软件包(如 create-react-app)的最新版本时，我会忽略这些警告。
当然，像 CRA 这样的库的维护者都知道这些警告，如果问题严重，他们会立即修复它们。
确保这些警告无害的另一种方法是检查 reported issues of the create-react-app或任何其他图书馆，看看 react 是什么。
我强烈建议您阅读上述文章，npm audit: Broken by Design .