41 vulnerabilities (34 moderate, 7 high)

• Laravel Framework 8.46.0
• Laravel Mix Version: npm list --depth=0

├── laravel-mix@6.0.19 ├── lodash@4.17.21 └── postcss@8.3.0

• Node Version (node -v): v15.10.0
• NPM Version (npm -v): 7.6.0
• OS: MacOSx Big Sur version 11.4, Apple silicon

Description:

Just installed fresh Laravel, and run npm install I am getting this error: 41 vulnerabilities (34 moderate, 7 high)

Steps To Reproduce:

Install new laravel instance Run npm install

[thecrypticace]

So I updated some stuff in our master branch over the weekend however, even if we tag a release, it won’t fix some vulnerabilities still present in dependencies.

1. One is present in css-what depended upon by svgo.
2. One is present in glob-parent due to @types/browser-sync pulling in an old version of chokidar.
3. One is because resolve-url-loader pulls in a vulnerable version of postcss (when it should be a peer dep).

We should still tag a new release though. I’ll see if we can do that soon.

[johnneijzen]

so far my side only 7 high vulnerabilities from css-what from svgo so it is getting better