Oddities with npm - Githubissues

frederikhors commented 3 years ago

Why do we have v1.3.1 on npmjs?
Why npm 7 is suggesting me to upgrade to @ericblade/quagga2 @ 0.0.1?

Why npm audit shows the below?

# npm audit report

netmask  <2.0.1
Severity: high
netmask npm package vulnerable to octal input data - https://npmjs.com/advisories/1658
fix available via `npm audit fix --force`
Will install @ericblade/quagga2@0.0.1, which is a breaking change
node_modules/netmask
pac-resolver  *
Depends on vulnerable versions of netmask
node_modules/pac-resolver
  pac-proxy-agent  *
  Depends on vulnerable versions of pac-resolver
  node_modules/pac-proxy-agent
    proxy-agent  >=1.1.0
    Depends on vulnerable versions of pac-proxy-agent
    node_modules/proxy-agent
      snyk  1.0.0-dev-0448474ef2a9d3009ecc6998307a398ff16a6b15 - 1.0.0-dev-fc3db6eac42b7609f7dc992551e3718ce0009604 || >=1.76.0
      Depends on vulnerable versions of proxy-agent
      node_modules/snyk
        @ericblade/quagga2  >=0.0.2
        Depends on vulnerable versions of snyk
        node_modules/@ericblade/quagga2

6 high severity vulnerabilities

In my package.json I have this:

"@ericblade/quagga2": "1.2.6",

which works great, but today I wanted to upgrade.

github-actions[bot] commented 3 years ago

Thank you for filing an issue! Please be patient. :-)

ericblade commented 3 years ago

Hi there! Thanks for the question.

1.3.1 is on npm because that was the last change that had a version bump.

As for what npm 7 is telling you -- It looks like for some reason it thinks that any version higher than 0.0.2 will include snyk (this is probably correct), and snyk includes netmask, which apparently v2.0.1 and less, it finds disagreeable. If snyk has upgraded netmask in their dependencies, or whatever child of theirs needs it, then i could probably go ahead and do a dependency update patch release. There's another pull req for a highly recommended dep upgrade too, so maybe kill two birds with one stone there. I don't know right off hand how to see if snyk has solved that problem in their newest patches or not.

frederikhors commented 3 years ago

Ok. My question about 1.3.1 is because I cannot find this release in the list:

ericblade commented 3 years ago

i haven't perfected the automatic release process, and i probably forgot to submit a tag :-) thanks for pointing it out

ericblade commented 3 years ago

snyk has been removed, we're a couple of releases ahead now, i don't think there's much actionable here

ericblade / quagga2

Oddities with npm #347