How to fix vulnerabilities?

When trying to start frontend, after installing all dependencies, I got 300+ vulnerabilities required for manual fix and 3 packages involve breaking updates. I’m pretty new to npm, is there any guide to fix these vulnerabilities?

[mikaelengstrom]

Yeah, we have not updated the frontend dev-server for quite some time now and are evaluating to replace it in favor for create react app which will somewhat resolve the issue. AFAIK there is no automatic way of fixing this, so its more or less manual upgrading and resolving breaking changes that is needed. However, these vulnerabilities is not always alarming since the dev-dependencies will only live on your local machine. I would probably focus on upgrading everything in the non-dev list which is not much and then live with the warnings.

The thing with npm and npm audit is that most packages have dependencies, that have dependencies which also have dependencies and so it goes. If any of those deps have a known issue it will get reported, so if you want to keep vulnerabillity-list at zero you will not spend much time on actually building stuff. I tried doing a “npm audit fix” (which automaticly resolve as much as it can) on a fresh Wagtail-Pipit install and after that there were no vulnrabillity of class “High”, and all remaining vulnurabillities were dependencies of [dev]-packages, so i would not worry too much about it.

This is kind of a nice read on the topic of npm audit warnings and description of the problem: https://www.voitanos.io/blog/don-t-be-alarmed-by-vulnerabilities-after-running-npm-install

For progress on dev-server replacement, follow: #168

[marteinn]

I just released 6.2.0 (https://github.com/Frojd/Wagtail-Pipit/releases/tag/v6.2.0) that solves this issue, Thanks to @adsee42 for raising the issue and @mikaelengstrom and @rinti for your wise words.