npm パッケージの脆弱性 gulp導入後、出てくる脆弱性ファイルへの警告
解決したいこと
脆弱性ファイルへの対処の仕方
脆弱性ファイルへの考え方(gulpは最新版なのになぜ脆弱性を含むファイルが作らるのか)
発生している問題・エラー
1~2年前にもgulp導入をしてサイトの環境構築をしていました。
この度久しぶりに再開し、インストールしているのですが、脆弱性ファイルへの警告が毎回出ます。
PS C:\Users\miyakotamura\OneDrive\デスクトップ\test\test1> npm init -y
Wrote to C:\Users\miyakotamura\OneDrive\デスクトップ\test\test1\package.json:
{
"name": "test1",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"keywords": [],
"author": "",
"license": "ISC"
}
PS C:\Users\miyakotamura\OneDrive\デスクトップ\test\test1> npm install -D gulp
npm WARN deprecated source-map-url@0.4.1: See https://github.com/lydell/source-map-url#deprecated
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated source-map-resolve@0.5.3: See https://github.com/lydell/source-map-resolve#deprecated
npm WARN deprecated chokidar@2.1.8: Chokidar 2 does not receive security updates since 2019. Upgrade to chokidar 3 with 15x fewer dependencies
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
added 351 packages, and audited 352 packages in 27s
13 packages are looking for funding
run `npm fund` for details
6 high severity vulnerabilities
To address all issues, run:
npm audit fix
Run `npm audit` for details.
### 自分で試したこと
PS C:\Users\miyakotamura\OneDrive\デスクトップ\test\test1> npm audit
# npm audit report
glob-parent <5.1.2
Severity: high
glob-parent before 5.1.2 vulnerable to Regular Expression Denial of Service in enclosure regex - https://github.com/advisories/GHSA-ww39-953v-wcq6
fix available via `npm audit fix --force`
Will install gulp@3.9.1, which is a breaking change
node_modules/glob-parent
chokidar 1.0.0-rc1 - 2.1.8
Depends on vulnerable versions of glob-parent
node_modules/chokidar
glob-watcher 3.0.0 - 5.0.5
Depends on vulnerable versions of chokidar
node_modules/glob-watcher
glob-stream 5.3.0 - 6.1.0
Depends on vulnerable versions of glob-parent
node_modules/glob-stream
vinyl-fs 2.4.2 - 3.0.3
Depends on vulnerable versions of glob-stream
node_modules/vinyl-fs
gulp >=4.0.0
Depends on vulnerable versions of glob-watcher
Depends on vulnerable versions of vinyl-fs
node_modules/gulp
6 high severity vulnerabilities
To address issues that do not require attention, run:
npm audit fix
To address all issues (including breaking changes), run:
npm audit fix --force
0 likes