RC6 installation fails: can't fix npm vulnerabilities

Hi, I’m trying to update Chia to RC6. RC5 worked fine. I’m on Linux Manjaro. This is what I get when I try to run install-gui.sh (within the activated venv):

$ sh install-gui.sh
install-gui.sh: line 17: type: apt-get: not found
install-gui.sh: line 21: type: yum: not found
install-gui.sh: line 26: type: yum: not found

Running git submodule update --init --recursive.

Running git submodule update.


up to date, audited 2811 packages in 4s

2 low severity vulnerabilities

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

up to date, audited 2811 packages in 5s

# npm audit report

xmldom  <0.5.0
Misinterpretation of malicious XML input - https://npmjs.com/advisories/1650
fix available via `npm audit fix`
node_modules/xmldom
  plist  >=0.3.2
  Depends on vulnerable versions of xmldom
  node_modules/plist

2 low severity vulnerabilities

To address all issues, run:
  npm audit fix

And the installation fails. So, I run:

$ npm audit fix
npm ERR! code ENOLOCK
npm ERR! audit This command requires an existing lockfile.
npm ERR! audit Try creating one first with: npm i --package-lock-only
npm ERR! audit Original error: loadVirtual requires existing shrinkwrap file

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/user/.npm/_logs/2021-03-13T08_48_19_342Z-debug.log

Here’s the log file:

0 verbose cli [ '/usr/bin/node', '/usr/bin/npm', 'audit', 'fix' ]
1 info using npm@7.6.0
2 info using node@v15.10.0
3 timing config:load:defaults Completed in 1ms
4 timing config:load:file:/usr/lib/node_modules/npm/npmrc Completed in 0ms
5 timing config:load:builtin Completed in 0ms
6 timing config:load:cli Completed in 2ms
7 timing config:load:env Completed in 0ms
8 timing config:load:file:/home/user/chia-blockchain/.npmrc Completed in 0ms
9 timing config:load:project Completed in 1ms
10 timing config:load:file:/home/user/.npmrc Completed in 0ms
11 timing config:load:user Completed in 0ms
12 timing config:load:file:/usr/etc/npmrc Completed in 0ms
13 timing config:load:global Completed in 0ms
14 timing config:load:cafile Completed in 1ms
15 timing config:load:validate Completed in 0ms
16 timing config:load:setUserAgent Completed in 0ms
17 timing config:load:setEnvs Completed in 1ms
18 timing config:load Completed in 6ms
19 verbose npm-session 3934fa82d8619ad5
20 timing npm:load Completed in 12ms
21 timing arborist:ctor Completed in 1ms
22 timing command:audit Completed in 7ms
23 verbose stack Error: loadVirtual requires existing shrinkwrap file
23 verbose stack     at Arborist.loadVirtual (/usr/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/load-virtual.js:57:18)
23 verbose stack     at async Arborist.audit (/usr/lib/node_modules/npm/node_modules/@npmcli/arborist/lib/arborist/audit.js:23:18)
23 verbose stack     at async audit (/usr/lib/node_modules/npm/lib/audit.js:15:3)
24 verbose cwd /home/user/chia-blockchain
25 verbose Linux 5.11.2-1-MANJARO
26 verbose argv "/usr/bin/node" "/usr/bin/npm" "audit" "fix"
27 verbose node v15.10.0
28 verbose npm  v7.6.0
29 error code ENOLOCK
30 error audit This command requires an existing lockfile.
31 error audit Try creating one first with: npm i --package-lock-only
32 error audit Original error: loadVirtual requires existing shrinkwrap file
33 verbose exit 1

As suggested I run:

$ npm i --package-lock-only

up to date, audited 1 package in 184ms

found 0 vulnerabilities

And then again:

$ npm audit fix

up to date, audited 1 package in 184ms

found 0 vulnerabilities

But when I retry the installation nothing is fixed and I get the same audit error:

$ sh install-gui.sh
install-gui.sh: line 17: type: apt-get: not found
install-gui.sh: line 21: type: yum: not found
install-gui.sh: line 26: type: yum: not found

Running git submodule update --init --recursive.

Running git submodule update.


up to date, audited 2811 packages in 4s

2 low severity vulnerabilities

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

up to date, audited 2811 packages in 5s

# npm audit report

xmldom  <0.5.0
Misinterpretation of malicious XML input - https://npmjs.com/advisories/1650
fix available via `npm audit fix`
node_modules/xmldom
  plist  >=0.3.2
  Depends on vulnerable versions of xmldom
  node_modules/plist

2 low severity vulnerabilities

To address all issues, run:
  npm audit fix

I already tried starting fresh by deleting the whole chia-blockchain folder and cloning from scratch, but I run into the same issue. I’m not familiar with npm, can someone help me? Thank you.

[Mirkbot]

I am running RC7 on Manjaro and I have the same problem:

sh ./install-gui.sh
./install-gui.sh: line 17: type: apt-get: not found
./install-gui.sh: line 21: type: yum: not found
./install-gui.sh: line 26: type: yum: not found

Running git submodule update --init --recursive.

Running git submodule update.


up to date, audited 2811 packages in 3s

2 low severity vulnerabilities

To address all issues, run:
  npm audit fix

Run `npm audit` for details.

up to date, audited 2811 packages in 4s

# npm audit report

xmldom  <0.5.0
Misinterpretation of malicious XML input - https://npmjs.com/advisories/1650
fix available via `npm audit fix`
node_modules/xmldom
  plist  >=0.3.2
  Depends on vulnerable versions of xmldom
  node_modules/plist

2 low severity vulnerabilities

To address all issues, run:
  npm audit fix

The install-gui.sh script does not continue after npm audit fix.

When running npm install && npm run locale:extract && npm run local:compile && npm run build manually I can compile the GUI. Here some npm info:

npm version
{
  npm: '7.6.3',
  node: '15.10.0',
  v8: '8.6.395.17-node.25',
  uv: '1.41.0',
  zlib: '1.2.11',
  brotli: '1.0.9',
  ares: '1.17.1',
  modules: '88',
  nghttp2: '1.41.0',
  napi: '7',
  llhttp: '2.1.3',
  openssl: '1.1.1j',
  cldr: '38.1',
  icu: '68.2',
  tz: '2020d',
  unicode: '13.0'
}

Linux Kernel is 5.9.16-1 (stable Manjaro release)

[seeden]

fixed via https://github.com/Chia-Network/chia-blockchain-gui/pull/238