Repository navigation
Vulnerability Prototype Pollution #142
Description
A few days ago I went to install my project's packages and npm pointed out 4 critical security errors, but I couldn't understand the solution for it, I didn't find issues that matched the current problem, can you help me?
When running the command npm audit it shows the following text:
# npm audit report
merge <2.1.1
Severity: high
Prototype Pollution - https://npmjs.com/advisories/1666
fix available via `npm audit fix --force`
Will install cz-conventional-changelog@3.0.1, which is a breaking change
node_modules/merge
find-node-modules <=2.1.0
Depends on vulnerable versions of merge
node_modules/find-node-modules
commitizen >=2.0.0
Depends on vulnerable versions of cz-conventional-changelog
Depends on vulnerable versions of find-node-modules
node_modules/commitizen
cz-conventional-changelog >=3.0.2
Depends on vulnerable versions of commitizen
node_modules/commitizen/node_modules/cz-conventional-changelog
node_modules/cz-conventional-changelog
4 high severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
These are the versions that I have installed
cz-cli@4.2.3
cz-conventional-changelog@3.3.0
Thanks in advance for your help.
About this Vulnerability: https://www.npmjs.com/advisories/1666
Reacted by Zwaar Contrast, Tiago Celestino, Ezra Free and Hyunbin Seo
Activity
ezrafree commentedon Feb 10, 2022
I just ran into this issue as well.
If you're using
yarn, I was able to resolve this issue by adding aresolutionsobject to mypackage.json:aiKrice commentedon Apr 7, 2022
Please up