I need to utilize npm ls
to pinpoint the source of security warnings. Reference to the documentation states that:
Positional arguments consist of name@version-range identifiers, which will restrict the outcomes to only the paths leading to the specified packages.
My task involves addressing CVE-2020-7598 for the package minimist
, with details as follows:
CVE-2020-7598 Vulnerable versions: < 0.2.1 Patched version: 0.2.1
Running npm ls minimist
retrieves all dependencies tracked, but I aim to target a specific range. Thus far, attempts like the following have been made:
npm ls "minimist<0.2.1"
results inThe system cannot find the file specified.
npm ls "minimist@<0.2.1"
leads toThe system cannot find the file specified.
npm ls "minimist@<=0.2.0"
showsThe system cannot find the file specified.
yieldsnpm ls "<a href="/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="e68b8f888f8b8f9592a6d6c8d4c8d6">[email protected]</a>"
-- (empty)
(expected given e.g. 0.0.8 being present in my tree)
Hence, what approach should be taken to prompt npm ls
to display packages below a certain version within my dependency tree?