Oddities with npm

• Why do we have v1.3.1 on npmjs?

• Why npm 7 is suggesting me to upgrade to @ericblade/quagga2 @ 0.0.1?

• Why npm audit shows the below?

  # npm audit report
  
  netmask  <2.0.1
  Severity: high
  netmask npm package vulnerable to octal input data - https://npmjs.com/advisories/1658
  fix available via `npm audit fix --force`
  Will install @ericblade/quagga2@0.0.1, which is a breaking change
  node_modules/netmask
    pac-resolver  *
    Depends on vulnerable versions of netmask
    node_modules/pac-resolver
      pac-proxy-agent  *
      Depends on vulnerable versions of pac-resolver
      node_modules/pac-proxy-agent
        proxy-agent  >=1.1.0
        Depends on vulnerable versions of pac-proxy-agent
        node_modules/proxy-agent
          snyk  1.0.0-dev-0448474ef2a9d3009ecc6998307a398ff16a6b15 - 1.0.0-dev-fc3db6eac42b7609f7dc992551e3718ce0009604 || >=1.76.0
          Depends on vulnerable versions of proxy-agent
          node_modules/snyk
            @ericblade/quagga2  >=0.0.2
            Depends on vulnerable versions of snyk
            node_modules/@ericblade/quagga2
  
  6 high severity vulnerabilities
  

In my package.json I have this:

"@ericblade/quagga2": "1.2.6",

which works great, but today I wanted to upgrade.

[ericblade]

i haven’t perfected the automatic release process, and i probably forgot to submit a tag 😃 thanks for pointing it out

[ericblade]

snyk has been removed, we’re a couple of releases ahead now, i don’t think there’s much actionable here