sequelize-cli-typescript icon indicating copy to clipboard operation
sequelize-cli-typescript copied to clipboard

npm audit fix failed for 3.2.0-c - problem with yargs version

Open MarwanMirqah opened this issue 3 years ago • 0 comments

What you are doing?

running npm audit fix --force to fix vulnerability regarding sequalice-cli-typescript yargs dependency

npm audit report result

mem  <4.0.0
Severity: moderate
Denial of Service in mem - https://github.com/advisories/GHSA-4xcv-9jjx-gfj3
fix available via `npm audit fix --force`
Will install undefined@undefined, which is a breaking change
node_modules/mem
  os-locale  2.0.0 - 3.0.0
  Depends on vulnerable versions of mem
  node_modules/os-locale
    yargs  8.0.0-candidate.0 - 12.0.5
    Depends on vulnerable versions of os-locale
    Depends on vulnerable versions of yargs-parser
    node_modules/sequelize-cli-typescript/node_modules/yargs
      sequelize-cli-typescript  *
      Depends on vulnerable versions of yargs
      node_modules/sequelize-cli-typescript

yargs-parser  6.0.0 - 13.1.1
Severity: moderate
yargs-parser Vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-p9pc-299p-vxgp
fix available via `npm audit fix --force`
Will install undefined@undefined, which is a breaking change
node_modules/sequelize-cli-typescript/node_modules/yargs-parser
  yargs  8.0.0-candidate.0 - 12.0.5
  Depends on vulnerable versions of os-locale
  Depends on vulnerable versions of yargs-parser
  node_modules/sequelize-cli-typescript/node_modules/yargs
    sequelize-cli-typescript  *
    Depends on vulnerable versions of yargs
    node_modules/sequelize-cli-typescript

What do you expect to happen?

update yargs version

What is actually happening?

$ npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating sequelize-cli-typescript to undefined,which is a SemVer major change.
npm ERR! code ETARGET
npm ERR! notarget No matching version found for sequelize-cli-typescript@undefined.
npm ERR! notarget In most cases you or one of your dependencies are requesting
npm ERR! notarget a package version that doesn't exist.

MarwanMirqah avatar Aug 21 '22 12:08 MarwanMirqah