search

outsmartchad / solana-trading-cli

High-performance modules for develop Solana Trading Bots: CLI, gRPC bots, and low-latency integrations with Jito, bloXroute, Jupiter, and DEXes
MIT License
224 stars 106 forks source link

Has anyone encountered this problem when installing npm? #27

Closed cnstephen closed 1 month ago

cnstephen commented 1 month ago

step Installation 🛠️ git clone https://github.com/outsmartchad/solana-trading-cli.git cd solana-trading-cli nvm install nvm use npm install ts-node test.ts (Remember to run this to test all the cli script)

system ubuntu 22.04 node v22.2.0 npm 10.7.0

Report an error

ubuntu@VM-0-14-ubuntu:~/solana-trading-cli$ npm install
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @metaplex-foundation/mpl-token-metadata@3.0.0-alpha.27
npm warn Found: @metaplex-foundation/umi@0.9.1
npm warn node_modules/@metaplex-foundation/umi
npm warn   @metaplex-foundation/umi@"^0.9.1" from the root project
npm warn   13 more (@metaplex-foundation/mpl-candy-machine, ...)
npm warn
npm warn Could not resolve dependency:
npm warn peer @metaplex-foundation/umi@"^0.8.2" from @metaplex-foundation/mpl-token-metadata@3.0.0-alpha.27
npm warn node_modules/@metaplex-foundation/mpl-candy-machine/node_modules/@metaplex-foundation/mpl-token-metadata
npm warn   @metaplex-foundation/mpl-token-metadata@"3.0.0-alpha.27" from @metaplex-foundation/mpl-candy-machine@6.0.1
npm warn   node_modules/@metaplex-foundation/mpl-candy-machine
npm warn
npm warn Conflicting peer dependency: @metaplex-foundation/umi@0.8.10
npm warn node_modules/@metaplex-foundation/umi
npm warn   peer @metaplex-foundation/umi@"^0.8.2" from @metaplex-foundation/mpl-token-metadata@3.0.0-alpha.27
npm warn   node_modules/@metaplex-foundation/mpl-candy-machine/node_modules/@metaplex-foundation/mpl-token-metadata
npm warn     @metaplex-foundation/mpl-token-metadata@"3.0.0-alpha.27" from @metaplex-foundation/mpl-candy-machine@6.0.1
npm warn     node_modules/@metaplex-foundation/mpl-candy-machine

up to date, audited 1289 packages in 3s

154 packages are looking for funding
  run `npm fund` for details

34 vulnerabilities (12 low, 11 moderate, 8 high, 3 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.
ubuntu@VM-0-14-ubuntu:~/solana-trading-cli$ npm audit fix --force
npm warn using --force Recommended protections disabled.
npm warn audit Updating @metaplex-foundation/js to 0.20.1, which is a SemVer major change.
npm warn audit No fix available for @irys/sdk@*
npm warn audit No fix available for @mercurial-finance/dynamic-amm-sdk@*
npm warn audit Updating @bloxroute/solana-trader-client-ts to 2.2.0, which is a SemVer major change.
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: @metaplex-foundation/mpl-token-metadata@3.0.0-alpha.27
npm warn Found: @metaplex-foundation/umi@0.9.1
npm warn node_modules/@metaplex-foundation/umi
npm warn   peer @metaplex-foundation/umi@">= 0.8.2 < 1" from @metaplex-foundation/mpl-candy-machine@6.0.1
npm warn   node_modules/@metaplex-foundation/mpl-candy-machine
npm warn     @metaplex-foundation/mpl-candy-machine@"^6.0.1" from the root project
npm warn   13 more (@metaplex-foundation/mpl-token-metadata, ...)
npm warn
npm warn Could not resolve dependency:
npm warn peer @metaplex-foundation/umi@"^0.8.2" from @metaplex-foundation/mpl-token-metadata@3.0.0-alpha.27
npm warn node_modules/@metaplex-foundation/mpl-candy-machine/node_modules/@metaplex-foundation/mpl-token-metadata
npm warn   @metaplex-foundation/mpl-token-metadata@"3.0.0-alpha.27" from @metaplex-foundation/mpl-candy-machine@6.0.1
npm warn   node_modules/@metaplex-foundation/mpl-candy-machine
npm warn
npm warn Conflicting peer dependency: @metaplex-foundation/umi@0.8.10
npm warn node_modules/@metaplex-foundation/umi
npm warn   peer @metaplex-foundation/umi@"^0.8.2" from @metaplex-foundation/mpl-token-metadata@3.0.0-alpha.27
npm warn   node_modules/@metaplex-foundation/mpl-candy-machine/node_modules/@metaplex-foundation/mpl-token-metadata
npm warn     @metaplex-foundation/mpl-token-metadata@"3.0.0-alpha.27" from @metaplex-foundation/mpl-candy-machine@6.0.1
npm warn     node_modules/@metaplex-foundation/mpl-candy-machine
npm warn deprecated rimraf@3.0.2: Rimraf versions prior to v4 are no longer supported
npm warn deprecated aptos@1.8.5: Package aptos is no longer supported, please migrate to https://www.npmjs.com/package/@aptos-labs/ts-sdk
npm warn deprecated @irys/sdk@0.0.2: Arweave support is deprecated - We recommend migrating to the Irys datachain: https://migrate-to.irys.xyz/
npm warn deprecated @metaplex-foundation/js@0.20.1: Package no longer supported. Contact Support at https://www.npmjs.com/support for more info.

added 94 packages, removed 152 packages, changed 57 packages, and audited 1231 packages in 30s

204 packages are looking for funding
  run `npm fund` for details

# npm audit report

@solana/web3.js  1.73.0 - 1.73.4
Severity: high
Handling untrusted input can result in a crash, leading to loss of availability / denial of service - https://github.com/advisories/GHSA-8m45-2rjm-j347
fix available via `npm audit fix --force`
Will install @bloxroute/solana-trader-client-ts@1.3.5, which is a breaking change
node_modules/@bloxroute/solana-trader-client-ts/node_modules/@solana/web3.js
  @bloxroute/solana-trader-client-ts  1.3.6 - 2.0.0 || >=2.1.0
  Depends on vulnerable versions of @solana/web3.js
  Depends on vulnerable versions of axios
  node_modules/@bloxroute/solana-trader-client-ts

axios  0.8.1 - 0.27.2 || 1.0.0 - 1.5.1
Severity: moderate
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
Axios Cross-Site Request Forgery Vulnerability - https://github.com/advisories/GHSA-wf5p-g6vw-rhxx
fix available via `npm audit fix --force`
Will install @metaplex-foundation/js@0.19.5, which is a breaking change
node_modules/@bloxroute/solana-trader-client-ts/node_modules/axios
node_modules/aptos/node_modules/axios
  aptos  <=1.13.3
  Depends on vulnerable versions of axios
  node_modules/aptos
    @irys/sdk  *
    Depends on vulnerable versions of @ethersproject/contracts
    Depends on vulnerable versions of @ethersproject/providers
    Depends on vulnerable versions of @ethersproject/wallet
    Depends on vulnerable versions of aptos
    Depends on vulnerable versions of arbundles
    node_modules/@irys/sdk
    node_modules/@metaplex-foundation/js/node_modules/@irys/sdk
      @metaplex-foundation/js  >=0.20.0
      Depends on vulnerable versions of @irys/sdk
      node_modules/@metaplex-foundation/js

cross-fetch  <=2.2.3 || 2.2.5 || 3.0.0 - 3.1.4 || 3.2.0-alpha.0 - 3.2.0-alpha.2
Severity: high
Incorrect Authorization in cross-fetch - https://github.com/advisories/GHSA-7gc6-qh9x-w6h8
Depends on vulnerable versions of node-fetch
No fix available
node_modules/@solana/spl-token-registry/node_modules/cross-fetch
  @solana/spl-token-registry  >=0.2.26
  Depends on vulnerable versions of cross-fetch
  node_modules/@solana/spl-token-registry
    @mercurial-finance/dynamic-amm-sdk  *
    Depends on vulnerable versions of @mercurial-finance/vault-sdk
    Depends on vulnerable versions of @solana/spl-token-registry
    node_modules/@mercurial-finance/dynamic-amm-sdk
    @mercurial-finance/vault-sdk  *
    Depends on vulnerable versions of @solana/spl-token-registry
    node_modules/@mercurial-finance/vault-sdk

elliptic  2.0.0 - 6.5.6
Elliptic's EDDSA missing signature length check - https://github.com/advisories/GHSA-f7q4-pwc6-w24p
Elliptic's ECDSA missing check for whether leading bit of r and s is zero - https://github.com/advisories/GHSA-977x-g7h5-7qgw
Elliptic allows BER-encoded signatures - https://github.com/advisories/GHSA-49q7-c7j4-3p7m
fix available via `npm audit fix --force`
Will install @metaplex-foundation/js@0.19.5, which is a breaking change
node_modules/elliptic
  @ethersproject/signing-key  <=5.7.0
  Depends on vulnerable versions of elliptic
  node_modules/@ethersproject/signing-key
    @ethersproject/hdnode  *
    Depends on vulnerable versions of @ethersproject/abstract-signer
    Depends on vulnerable versions of @ethersproject/signing-key
    Depends on vulnerable versions of @ethersproject/transactions
    Depends on vulnerable versions of @ethersproject/wordlists
    node_modules/@ethersproject/hdnode
      @ethersproject/json-wallets  *
      Depends on vulnerable versions of @ethersproject/abstract-signer
      Depends on vulnerable versions of @ethersproject/hdnode
      Depends on vulnerable versions of @ethersproject/transactions
      node_modules/@ethersproject/json-wallets
    @ethersproject/transactions  <=5.7.0
    Depends on vulnerable versions of @ethersproject/signing-key
    node_modules/@ethersproject/transactions
      @ethersproject/abstract-provider  *
      Depends on vulnerable versions of @ethersproject/transactions
      node_modules/@ethersproject/abstract-provider
        @ethersproject/abstract-signer  *
        Depends on vulnerable versions of @ethersproject/abstract-provider
        node_modules/@ethersproject/abstract-signer
          @ethersproject/hash  5.0.6 - 5.7.0
          Depends on vulnerable versions of @ethersproject/abstract-signer
          node_modules/@ethersproject/hash
            @ethersproject/abi  5.0.10 - 5.7.0
            Depends on vulnerable versions of @ethersproject/hash
            node_modules/@ethersproject/abi
              @ethersproject/contracts  *
              Depends on vulnerable versions of @ethersproject/abi
              Depends on vulnerable versions of @ethersproject/abstract-provider
              Depends on vulnerable versions of @ethersproject/abstract-signer
              Depends on vulnerable versions of @ethersproject/transactions
              node_modules/@ethersproject/contracts
            @ethersproject/providers  <=5.7.2
            Depends on vulnerable versions of @ethersproject/abstract-provider
            Depends on vulnerable versions of @ethersproject/abstract-signer
            Depends on vulnerable versions of @ethersproject/hash
            Depends on vulnerable versions of @ethersproject/transactions
            Depends on vulnerable versions of ws
            node_modules/@ethersproject/providers
              arbundles  >=0.9.3
              Depends on vulnerable versions of @ethersproject/hash
              Depends on vulnerable versions of @ethersproject/providers
              Depends on vulnerable versions of @ethersproject/signing-key
              Depends on vulnerable versions of @ethersproject/transactions
              Depends on vulnerable versions of @ethersproject/wallet
              node_modules/@metaplex-foundation/js/node_modules/arbundles
              node_modules/arbundles
            @ethersproject/wallet  <=5.7.0
            Depends on vulnerable versions of @ethersproject/abstract-provider
            Depends on vulnerable versions of @ethersproject/abstract-signer
            Depends on vulnerable versions of @ethersproject/hash
            Depends on vulnerable versions of @ethersproject/hdnode
            Depends on vulnerable versions of @ethersproject/json-wallets
            Depends on vulnerable versions of @ethersproject/signing-key
            Depends on vulnerable versions of @ethersproject/transactions
            Depends on vulnerable versions of @ethersproject/wordlists
            node_modules/@ethersproject/wallet
            @ethersproject/wordlists  5.0.8 - 5.7.0
            Depends on vulnerable versions of @ethersproject/hash
            node_modules/@ethersproject/wordlists

node-fetch  <2.6.7
Severity: high
node-fetch forwards secure headers to untrusted sites - https://github.com/advisories/GHSA-r683-j2x4-v87g
No fix available
node_modules/@solana/spl-token-registry/node_modules/node-fetch

ws  7.0.0 - 7.5.9
Severity: high
ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
fix available via `npm audit fix --force`
Will install @metaplex-foundation/js@0.19.5, which is a breaking change
node_modules/@ethersproject/providers/node_modules/ws

26 vulnerabilities (12 low, 6 moderate, 8 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

How to solve it

outsmartchad commented 1 month ago

just npm install, and don't need to fix anything, and follow the instructions from my doc.

cnstephen commented 1 month ago

ok, thank u