search

jhipster / jhipster-vuejs

A Vue.js blueprint for JHipster. It will use Vue.js as the frontend library!
https://www.jhipster.tech
Apache License 2.0
301 stars 179 forks source link

Project creation completed npm audit fix --force exception #653

Closed TomYule closed 3 years ago

TomYule commented 3 years ago 
 jhipster info
INFO! Using JHipster version installed locally in current project's node_modules
INFO! No custom sharedOptions found within blueprint: generator-jhipster-vuejs at /Users/kricss/IdeaProjects/YueXinJhipster/node_modules/generator-jhipster-vuejs
INFO! No custom commands found within blueprint: generator-jhipster-vuejs at /Users/kricss/IdeaProjects/YueXinJhipster/node_modules/generator-jhipster-vuejs
INFO! Executing jhipster:info
Welcome to the JHipster Information Sub-Generator

##### **JHipster Version(s)**

yue-xin-jhipster@0.0.0 /Users/kricss/IdeaProjects/YueXinJhipster └─┬ generator-jhipster-vuejs@0.0.3 └── generator-jhipster@6.10.5


##### **JHipster configuration, a `.yo-rc.json` file generated in the root folder**

<details>
<summary>.yo-rc.json file</summary>
<pre>
{
  "generator-jhipster": {
    "promptValues": {
      "packageName": "com.yuexin",
      "nativeLanguage": "zh-cn"
    },
    "jhipsterVersion": "6.10.5",
    "applicationType": "monolith",
    "baseName": "YueXinJhipster",
    "packageName": "com.yuexin",
    "packageFolder": "com/yuexin",
    "serverPort": "8080",
    "authenticationType": "session",
    "cacheProvider": "caffeine",
    "enableHibernateCache": false,
    "websocket": false,
    "databaseType": "sql",
    "devDatabaseType": "mysql",
    "prodDatabaseType": "mysql",
    "searchEngine": false,
    "messageBroker": false,
    "serviceDiscoveryType": false,
    "buildTool": "maven",
    "enableSwaggerCodegen": false,
    "rememberMeKey": "YourJWTSecretKeyWasReplacedByThisMeaninglessTextByTheJHipsterInfoCommandForObviousSecurityReasons",
    "embeddableLaunchScript": false,
    "useSass": true,
    "clientPackageManager": "npm",
    "clientFramework": "vue",
    "clientTheme": "none",
    "clientThemeVariant": "",
    "creationTimestamp": 1612346951063,
    "testFrameworks": [],
    "jhiPrefix": "jhi",
    "entitySuffix": "",
    "dtoSuffix": "DTO",
    "otherModules": [
      {
        "name": "generator-jhipster-vuejs",
        "version": "1.9.2"
      }
    ],
    "enableTranslation": true,
    "nativeLanguage": "zh-cn",
    "languages": ["zh-cn", "en"],
    "blueprints": [
      {
        "name": "generator-jhipster-vuejs",
        "version": "1.9.2"
      }
    ]
  }
}

</pre>
</details>

##### **JDL for the Entity configuration(s) `entityName.json` files generated in the `.jhipster` directory**

<details>
<summary>JDL entity definitions</summary>

<pre>

</pre>
</details>

##### **Environment and Tools**

java version "1.8.0_241"
Java(TM) SE Runtime Environment (build 1.8.0_241-b07)
Java HotSpot(TM) 64-Bit Server VM (build 25.241-b07, mixed mode)

git version 2.23.0

node: v14.8.0

npm: 7.5.2

yarn: 1.22.4

Docker version 19.03.12, build 48a66213fe

docker-compose version 1.26.2, build eefe0d31

INFO! Congratulations, JHipster execution is complete!
Overview of the issue

Project creation completed npm audit fix --force exception

npm WARN using --force Recommended protections disabled.
npm WARN audit Updating generator-jhipster-vuejs to 0.0.3,which is a SemVer major change.
npm WARN deprecated formatio@1.1.1: This package is unmaintained. Use @sinonjs/formatio instead
npm WARN deprecated samsam@1.1.2: This package has been deprecated in favour of @sinonjs/samsam
npm WARN deprecated cross-spawn-async@2.2.5: cross-spawn no longer requires a build toolchain, use it instead
npm WARN deprecated gulp-util@3.0.8: gulp-util is deprecated - replace it, following the guidelines at https://medium.com/gulpjs/gulp-util-ca3b1f9f9ac5

added 374 packages, removed 88 packages, changed 14 packages, and audited 2751 packages in 44s

101 packages are looking for funding
  run `npm fund` for details

# npm audit report

axios  <0.21.1
Severity: high
Server-Side Request Forgery - https://npmjs.com/advisories/1594
fix available via `npm audit fix`
node_modules/generator-jhipster/node_modules/axios
  generator-jhipster  2.19.0 - 7.0.0-beta.0
  Depends on vulnerable versions of axios
  Depends on vulnerable versions of jhipster-core
  Depends on vulnerable versions of lodash
  node_modules/generator-jhipster

braces  <2.3.1
Regular Expression Denial of Service - https://npmjs.com/advisories/786
fix available via `npm audit fix`
node_modules/glob-stream/node_modules/braces
  micromatch  0.2.0 - 2.3.11
  Depends on vulnerable versions of braces
  node_modules/glob-stream/node_modules/micromatch
    glob-stream  5.3.0 - 5.3.5
    Depends on vulnerable versions of micromatch
    node_modules/glob-stream
      vinyl-fs  2.4.2 - 2.4.4
      Depends on vulnerable versions of glob-stream
      node_modules/vinyl-fs

decompress  <4.2.1
Severity: high
Arbitrary File Write - https://npmjs.com/advisories/1217
fix available via `npm audit fix --force`
Will install generator-jhipster-vuejs@1.9.2, which is a breaking change
node_modules/decompress
  gulp-decompress  <=1.2.0
  Depends on vulnerable versions of decompress
  node_modules/gulp-decompress
    download  4.0.0 - 5.0.0
    Depends on vulnerable versions of caw
    Depends on vulnerable versions of gulp-decompress
    node_modules/download
      yeoman-generator  <=0.24.1
      Depends on vulnerable versions of download
      Depends on vulnerable versions of html-wiring
      Depends on vulnerable versions of inquirer
      Depends on vulnerable versions of lodash
      node_modules/generator-jhipster-vuejs/node_modules/yeoman-generator
        generator-jhipster-vuejs  <=0.0.3
        Depends on vulnerable versions of yeoman-generator
        node_modules/generator-jhipster-vuejs

deep-extend  <=0.5.0
Prototype Pollution - https://npmjs.com/advisories/612
fix available via `npm audit fix`
node_modules/generator-jhipster-vuejs/node_modules/deep-extend
  mem-fs-editor  2.1.0 - 3.0.2
  Depends on vulnerable versions of deep-extend
  node_modules/generator-jhipster-vuejs/node_modules/mem-fs-editor

lodash  <=4.17.18
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1065
Prototype Pollution - https://npmjs.com/advisories/1523
Prototype Pollution - https://npmjs.com/advisories/577
Prototype Pollution - https://npmjs.com/advisories/782
fix available via `npm audit fix --force`
Will install generator-jhipster-vuejs@1.9.2, which is a breaking change
node_modules/cheerio/node_modules/lodash
node_modules/generator-jhipster-vuejs/node_modules/lodash
node_modules/generator-jhipster/node_modules/lodash
node_modules/jhipster-core/node_modules/lodash
  cheerio  0.14.0 - 0.19.0
  Depends on vulnerable versions of lodash
  node_modules/cheerio
    html-wiring  *
    Depends on vulnerable versions of cheerio
    node_modules/html-wiring
      yeoman-generator  <=0.24.1
      Depends on vulnerable versions of download
      Depends on vulnerable versions of html-wiring
      Depends on vulnerable versions of inquirer
      Depends on vulnerable versions of lodash
      node_modules/generator-jhipster-vuejs/node_modules/yeoman-generator
        generator-jhipster-vuejs  <=0.0.3
        Depends on vulnerable versions of yeoman-generator
        node_modules/generator-jhipster-vuejs
  generator-jhipster  2.19.0 - 7.0.0-beta.0
  Depends on vulnerable versions of axios
  Depends on vulnerable versions of jhipster-core
  Depends on vulnerable versions of lodash
  node_modules/generator-jhipster
  inquirer  <=0.11.4
  Depends on vulnerable versions of lodash
  node_modules/generator-jhipster-vuejs/node_modules/inquirer
  jhipster-core  *
  Depends on vulnerable versions of lodash
  node_modules/jhipster-core

tunnel-agent  <0.6.0
Severity: moderate
Memory Exposure - https://npmjs.com/advisories/598
fix available via `npm audit fix --force`
Will install generator-jhipster-vuejs@1.9.2, which is a breaking change
node_modules/caw/node_modules/tunnel-agent
  caw  <=2.0.0
  Depends on vulnerable versions of tunnel-agent
  node_modules/caw
    download  4.0.0 - 5.0.0
    Depends on vulnerable versions of caw
    Depends on vulnerable versions of gulp-decompress
    node_modules/download
      yeoman-generator  <=0.24.1
      Depends on vulnerable versions of download
      Depends on vulnerable versions of html-wiring
      Depends on vulnerable versions of inquirer
      Depends on vulnerable versions of lodash
      node_modules/generator-jhipster-vuejs/node_modules/yeoman-generator
        generator-jhipster-vuejs  <=0.0.3
        Depends on vulnerable versions of yeoman-generator
        node_modules/generator-jhipster-vuejs

20 vulnerabilities (7 low, 2 moderate, 11 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force
Motivation for or Use Case
Reproduce the error
Related issues
Suggest a Fix
JHipster Version(s)
JHipster configuration
Entity configuration(s) entityName.json files generated in the .jhipster directory
Browsers and Operating System

This problem has been bothering me for a long time and I don't know how to solve it. Please help me

TomYule commented 3 years ago

I updated NodeJS to fix it

pascalgrimaud commented 3 years ago

I advise you to use directly generator-jhipster@beta -> see https://www.jhipster.tech/2020/12/21/jhipster-release-7.0.0-beta.0.html As the support of Vue.js has been merged into main project