Skip to content

npm audit fix failed for 3.2.0-c - problem with yargs version #14

@MarwanMirqah

Description

@MarwanMirqah

What you are doing?

running npm audit fix --force to fix vulnerability regarding sequalice-cli-typescript yargs dependency

npm audit report result

mem  <4.0.0
Severity: moderate
Denial of Service in mem - https://github.com/advisories/GHSA-4xcv-9jjx-gfj3
fix available via `npm audit fix --force`
Will install undefined@undefined, which is a breaking change
node_modules/mem
  os-locale  2.0.0 - 3.0.0
  Depends on vulnerable versions of mem
  node_modules/os-locale
    yargs  8.0.0-candidate.0 - 12.0.5
    Depends on vulnerable versions of os-locale
    Depends on vulnerable versions of yargs-parser
    node_modules/sequelize-cli-typescript/node_modules/yargs
      sequelize-cli-typescript  *
      Depends on vulnerable versions of yargs
      node_modules/sequelize-cli-typescript

yargs-parser  6.0.0 - 13.1.1
Severity: moderate
yargs-parser Vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-p9pc-299p-vxgp
fix available via `npm audit fix --force`
Will install undefined@undefined, which is a breaking change
node_modules/sequelize-cli-typescript/node_modules/yargs-parser
  yargs  8.0.0-candidate.0 - 12.0.5
  Depends on vulnerable versions of os-locale
  Depends on vulnerable versions of yargs-parser
  node_modules/sequelize-cli-typescript/node_modules/yargs
    sequelize-cli-typescript  *
    Depends on vulnerable versions of yargs
    node_modules/sequelize-cli-typescript

What do you expect to happen?

update yargs version

What is actually happening?

$ npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating sequelize-cli-typescript to undefined,which is a SemVer major change.
npm ERR! code ETARGET
npm ERR! notarget No matching version found for sequelize-cli-typescript@undefined.
npm ERR! notarget In most cases you or one of your dependencies are requesting
npm ERR! notarget a package version that doesn't exist.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions