Repository navigation
Question About 6 high severity vulnerabilities #13227
Description
I am getting this as message in my terminal that the package contains 6 high severity vulnerabilities. Is it safe to go with this package these days.
I am new with this type of project. I am unable to understand all things mentioned about this topic on internet. Can anyone help to understand, Is it really be a problem which can lead to data loss or backend tracking.
Activity
dave9123 commentedon Jun 11, 2023
Try running
npm i @svgr/webpack --save-devjrjake commentedon Jun 12, 2023
See issue #11174, it is OK to ignore this warning.
denezra commentedon Jun 16, 2023
@wfjake Hmm is there a way to fix this just to ignore it? Because this will cause to detect on my CSEC scan.
dave9123 commentedon Jun 20, 2023
Might help you :)
denezra commentedon Jun 20, 2023
@dave9123 Still the same good sir
dave9123 commentedon Jun 21, 2023
Can I see which package?
npm audit reportdenezra commentedon Jun 21, 2023
Hi @dave9123, here's the
npm audit reportnth-check <2.0.1
Severity: high
Inefficient Regular Expression Complexity in nth-check - GHSA-rp65-9cf3-cjxr
fix available via
npm audit fix --forceWill install react-scripts@2.1.3, which is a breaking change
node_modules/react-scripts/node_modules/nth-check
css-select <=3.1.0
Depends on vulnerable versions of nth-check
node_modules/react-scripts/node_modules/css-select
svgo 1.0.0 - 1.3.2
Depends on vulnerable versions of css-select
node_modules/react-scripts/node_modules/svgo
@svgr/plugin-svgo <=5.5.0
Depends on vulnerable versions of svgo
node_modules/react-scripts/node_modules/@svgr/plugin-svgo
@svgr/webpack 4.0.0 - 5.5.0
Depends on vulnerable versions of @svgr/plugin-svgo
node_modules/react-scripts/node_modules/@svgr/webpack
react-scripts >=2.1.4
Depends on vulnerable versions of @svgr/webpack
node_modules/react-scripts
If the Devs truly abandoned this project(Based on this discussion here) I might try to migrate to other framework like Vite, Next, or Svelte.
dave9123 commentedon Jun 21, 2023
I forgot that you need to modify your nth-check version,
"overrides": { "nth-check": "2.0.1" },Should be something like this
dave9123 commentedon Jun 21, 2023
Here's me being confused, again
