npm 如何修复@vue/cli漏洞?

jei2mxaa  于 2023-01-09  发布在  其他
关注(0)|答案(4)|浏览(179)

我有vuejs-3项目,我正在寻找0个漏洞。当我安装npm时,我在当前版本节点和npm中发现48个漏洞。即使我尝试npm审计修复--强制仍然问题相同。有人能帮助我吗?

C:\Users\achalapa\git\cnsr-odrplat-wcm-cld-vue\mcafee-consumer-wcm-cld-vue.lib> npm install

-npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained

-npm WARN deprecated @hapi/topo@3.1.6: This version has been deprecated and is no longer supported or maintained

-npm WARN deprecated har-validator@5.1.5: this library is no longer supported

-npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.

-npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.

-npm WARN deprecated html-webpack-plugin@3.2.0: 3.x is no longer supported

-npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.

-npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142

-npm WARN deprecated @hapi/hoek@8.5.1: This version has been deprecated and is no longer supported or maintained

-npm WARN deprecated @hapi/joi@15.1.1: Switch to 'npm install joi'

-added 923 packages, and audited 1694 packages in 4m

-105 packages are looking for funding
  run `npm fund` for details

-48 moderate severity vulnerabilities

-To address issues that do not require attention, run:
  npm audit fix

-To address all issues (including breaking changes), run:
  npm audit fix --force

48个漏洞在添加以下软件包时出现

*"@vue/cli-plugin-babel": "~4.5.13",
"@vue/cli-plugin-typescript": "~4.5.13",
"@vue/cli-plugin-vuex": "~4.5.13",
"@vue/cli-service": "4.5.13",*

是否可以继续?这是否对我的项目有害?

package.json

{
  "name": "mcafee-consumer-wcm-cld-vue.lib",
  "version": "1.0.0",
  "private": true,
  "sideEffects": false,
  "scripts": {
    "bundle": "set NODE_ENV=production && npm run lint && webpack --config webpack.dlp.js --progress --mode=production",
    "bundle-dev": "set NODE_ENV=development && npm run lint && webpack --config webpack.dlp.js --progress --mode=development",
    "lint": "eslint . --ext .ts,.js --ignore-pattern src/**/*.d.ts",
    "lint-and-fix": "eslint . --ext .ts --fix"
  },
  "dependencies": {
    "@vuelidate/core": "^2.0.0-alpha.18",
    "bootstrap": "^5.0.1",
    "core-js": "^3.13.0",
    "intersection-observer": "^0.12.0",
    "vue": "^3.0.0",
    "vuex": "^4.0.0-0",
    "whatwg-fetch": "^3.6.2"
  },
  "devDependencies": {
    "@babel/core": "^7.14.3",
    "@babel/plugin-syntax-dynamic-import": "^7.8.3",
    "@babel/plugin-transform-arrow-functions": "^7.13.0",
    "@babel/plugin-transform-runtime": "^7.14.3",
    "@babel/preset-env": "^7.14.2",
    "@babel/preset-typescript": "^7.13.0",
    "@types/bootstrap": "^5.0.15",
    "@types/core-js": "^2.5.4",
    "@types/lodash": "^4.14.170",
    "@typescript-eslint/eslint-plugin": "^4.25.0",
    "@typescript-eslint/eslint-plugin-tslint": "^4.25.0",
    "@typescript-eslint/parser": "^4.25.0",
    "@vue/cli-plugin-babel": "~4.5.13",
    "@vue/cli-plugin-typescript": "~4.5.13",
    "@vue/cli-plugin-vuex": "~4.5.13",
    "@vue/cli-service": "4.5.13",
    "@vue/compiler-sfc": "^3.0.11",
    "@vue/eslint-config-prettier": "^6.0.0",
    "@vue/eslint-config-typescript": "^7.0.0",
    "babel-loader": "^8.2.2",
    "babel-preset-typescript-vue3": "^2.0.12",
    "clean-webpack-plugin": "^3.0.0",
    "eslint": "^7.27.0",
    "eslint-config-prettier": "^8.3.0",
    "eslint-loader": "^4.0.2",
    "eslint-plugin-jsdoc": "^35.0.0",
    "eslint-plugin-prettier": "^3.4.0",
    "eslint-plugin-vue": "^7.9.0",
    "fork-ts-checker-webpack-plugin": "^3.1.1",
    "html-webpack-plugin": "^5.3.1",
    "prettier": "^2.3.0",
    "terser-webpack-plugin": "^5.1.2",
    "ts-loader": "^9.2.2",
    "tslint": "^6.1.3",
    "typescript": "^4.3.2",
    "typescript-tslint-plugin": "^1.0.1",
    "vue-loader": "^16.2.0",
    "webpack": "^5.37.1",
    "webpack-bundle-analyzer": "^4.4.2",
    "webpack-cli": "^4.7.0",
    "webpack-merge": "^4.1.4"
  }
}
xytpbqjk

xytpbqjk1#

如果所有漏洞仅来自这4个软件包-即vue/cli,则您可以放心地忽略它,因为在开发和构建期间,此代码将在您自己的计算机上执行。如果我们同意我们信任Vue CLI的创建者,他们不会以有害于客户的方式使用这些有漏洞的软件包(开发人员使用Vue CLI),我们可以安全地忽略这些警告,因为这些包中的代码不会包含在应用程序包中......
您感兴趣的只是package.jsondependencies部分中包含的软件包漏洞,因为这些代码将成为最终应用程序捆绑包,并将由我们的用户/客户下载和执行
请改用以下命令:npm audit --only=prod

2w2cym1i

2w2cym1i2#

npm prune对我起作用了!
我有一个与npm install @vue/cli -g一起安装的额外包,称为subscriptions-transport-ws,它不再被维护,并使用了一堆过时的包。
修剪之后,我检查了一下,用npm ls subscriptions-transport-ws就没有了。我也没有漏洞了。

vsaztqbk

vsaztqbk3#

对于从**@vue/cli**收到漏洞警告的用户:
@vue/cli现在位于maintenance mode中,建议使用create-vue创建项目
从他们的网站:
⚠️ Vue CLI is in Maintenance Mode!
对于新项目,现在推荐使用create-vue来搭建基于Vite的项目,也可以参考Vue 3 Tooling Guide来获得最新的建议。

$ npm create vue@3

这将正确处理npm审计警告,此时您应该没有来自vue的警告。

bvk5enib

bvk5enib4#

当你试图创建项目时会发生这种情况吗?如果是的话,检查Windows中的系统环境变量,我的问题是只添加了一个路径,但你需要两个路径。一个在用户变量下为路径下的“YourUser”。
C:\程序文件\节点
系统变量下的第二个路径也在路径下
C:\程序文件\节点
这为我解决了问题,希望对我有帮助!

相关问题