search

pluralsight / web-dev-starter

302 stars 509 forks source link

CAN'T FIX FOUNDED VULNERABILITIES !!!! #8

Open fkazadi2 opened 4 years ago

fkazadi2 commented 4 years ago

1 package is looking for funding run npm fund for details

found 4 vulnerabilities (3 low, 1 high) run npm audit fix to fix them, or npm audit for details

lowwk1234 commented 4 years ago
  1. get the same problem. Try npm audit fix - the issue remains. Pls advise if this will cause problem down the road. Thx
saj120 commented 4 years ago

I am experiencing the same problem. Pls let me know when rectified.

00cm commented 4 years ago
  1. get the same problem. Try npm audit fix - the issue remains. Pls advise if this will cause problem down the road. Thx

I think this will be okay for learning purposes. Just don't go live with anything that you create here. For me, I ran npm audit fix and it fixed all 100+ vulnerabilities except one. But now I know which package I am going to avoid when I build my own websites. :)

Tonydarkness commented 2 years ago

I don't know if anyone still experiences this, but the async package is outdated and has high severity vulnerability, so it's better to uninstall the vulnerable packages by using npm uninstall <package-name> including async, browser-sync, port-scanner, and lite-server. Then, use npm install async to install the latest version. If you wanna preview the HTML files, use the live preview extension from Visual Studio Code instead.