forked from sequelize/cli
-
Notifications
You must be signed in to change notification settings - Fork 21
Open
Description
What you are doing?
running npm audit fix --force to fix vulnerability regarding sequalice-cli-typescript yargs dependency
npm audit report result
mem <4.0.0
Severity: moderate
Denial of Service in mem - https://github.com/advisories/GHSA-4xcv-9jjx-gfj3
fix available via `npm audit fix --force`
Will install undefined@undefined, which is a breaking change
node_modules/mem
os-locale 2.0.0 - 3.0.0
Depends on vulnerable versions of mem
node_modules/os-locale
yargs 8.0.0-candidate.0 - 12.0.5
Depends on vulnerable versions of os-locale
Depends on vulnerable versions of yargs-parser
node_modules/sequelize-cli-typescript/node_modules/yargs
sequelize-cli-typescript *
Depends on vulnerable versions of yargs
node_modules/sequelize-cli-typescript
yargs-parser 6.0.0 - 13.1.1
Severity: moderate
yargs-parser Vulnerable to Prototype Pollution - https://github.com/advisories/GHSA-p9pc-299p-vxgp
fix available via `npm audit fix --force`
Will install undefined@undefined, which is a breaking change
node_modules/sequelize-cli-typescript/node_modules/yargs-parser
yargs 8.0.0-candidate.0 - 12.0.5
Depends on vulnerable versions of os-locale
Depends on vulnerable versions of yargs-parser
node_modules/sequelize-cli-typescript/node_modules/yargs
sequelize-cli-typescript *
Depends on vulnerable versions of yargs
node_modules/sequelize-cli-typescript
What do you expect to happen?
update yargs version
What is actually happening?
$ npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating sequelize-cli-typescript to undefined,which is a SemVer major change.
npm ERR! code ETARGET
npm ERR! notarget No matching version found for sequelize-cli-typescript@undefined.
npm ERR! notarget In most cases you or one of your dependencies are requesting
npm ERR! notarget a package version that doesn't exist.
Metadata
Metadata
Assignees
Labels
No labels