Update 3: I'm uncertain about the main issue here - whether it's a problem with the package itself or something I might be doing incorrectly when attempting to resolve it. It would be helpful to know if anyone has successfully installed the dependencies listed in my package.json file without encountering any issues.
Update 2: Installing the same packages on a different machine results in only 2 vulnerabilities, but unfortunately, they don't seem to be fixable. NPM now suggests manual review instead of using the npm audit fix --force command. The ongoing culprit appears to be svg-sprite-loader.
Manual Review
Some vulnerabilities require your attention to resolve
Visit https://go.npm.me/audit-guide for additional guidance
Moderate Regular Expression Denial of Service in postcss
Package postcss
Patched in >=7.0.36
Dependency of svg-sprite-loader [dev]
Path svg-sprite-loader > svg-baker > postcss
More info https://github.com/advisories/GHSA-566m-qj78-rww5
Moderate Regular Expression Denial of Service in postcss
Package postcss
Patched in >=7.0.36
Dependency of svg-sprite-loader [dev]
Path svg-sprite-loader > svg-baker-runtime > svg-baker > postcss
More info https://github.com/advisories/GHSA-566m-qj78-rww5
found 2 moderate severity vulnerabilities in 459 scanned packages
2 vulnerabilities require manual review. See the full report for details.
Update: I am willing to consider eliminating svg-sprite-loader entirely if someone can provide alternate suggestions.
Upon running npm audit, 4 vulnerabilities are detected and it recommends making a drastic change to svg-sprite-loader (reverting from version 6 back to 2??).
This action resolves one vulnerability, but the remaining 3 do not appear to be affected by executing npm audit fix as advised. I am unsure how to proceed to address this issue.
npm: 8.10.0
Node: 16.14.0
webpack: 5.72.1
svg-sprite-loader: 6.0.11
The initial audit report prior to invoking npm audit fix --force:
postcss <7.0.36
Severity: moderate
Regular Expression Denial of Service in postcss - https://github.com/advisories/GHSA-566m-qj78-rww5
fix available via `npm audit fix --force`
Will install <a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="364540511b4546445f42531b5a5957525344760418061805">[email protected]</a>, which is a breaking change
node_modules/postcss
svg-baker >=1.2.5
Depends on vulnerable versions of postcss
node_modules/svg-baker
svg-baker-runtime >=1.4.0-alpha.10475b37
Depends on vulnerable versions of svg-baker
node_modules/svg-baker-runtime
svg-sprite-loader >=2.0.4
Depends on vulnerable versions of svg-baker
Depends on vulnerable versions of svg-baker-runtime
node_modules/svg-sprite-loader
4 moderate severity vulnerabilities
The report after running npm audit fix --force:
postcss <7.0.36
Severity: moderate
Regular Expression Denial of Service in postcss - https://github.com/advisories/GHSA-566m-qj78-rww5
fix available via `npm audit fix`
node_modules/postcss
svg-baker >=1.2.5
Depends on vulnerable versions of postcss
node_modules/svg-baker
svg-baker-runtime >=1.4.0-alpha.10475b37
Depends on vulnerable versions of svg-baker
node_modules/svg-baker-runtime
3 moderate severity vulnerabilities
Even after running npm audit fix, those vulnerabilities persist, leaving me puzzled on how to handle them. Any assistance from someone more knowledgeable on this matter would be greatly appreciated.
**Edit:
package.json before correction
{
"name": "vanilla-template",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC",
"devDependencies": {
"html-webpack-plugin": "^5.5.0",
"svg-sprite-loader": "^6.0.11",
"webpack": "^5.72.1",
"webpack-dev-server": "^4.9.0"
}
}
package.json after correction
{
"name": "vanilla-template",
"version": "1.0.0",
"description": "",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"
},
"author": "",
"license": "ISC",
"devDependencies": {
"html-webpack-plugin": "^5.5.0",
"svg-sprite-loader": "^2.0.3",
"webpack": "^5.72.1",
"webpack-dev-server": "^4.9.0"
}
}