After Npm Install save Must Install Be Run Again
Fixing security vulnerabilities in npm dependencies in less than 3 mins
Hola people!!! 🥑
It's been a while since I have written a blog and now since most of us are working from home, the time that used to go in commute is now saved and I thought why not utilize this time and write about my recent experience of fixing a security vulnerability.
So if any of you in the recent time have seen something like this image below and have no clue how to fix it then this article is for you. When I saw it, I had no clue either but with some research I could fix this.
🔬 Problem:
So what this means is one of the dependencies in your package.json has some security implications which can be exploited by an attacker and can cause problems for you, your product, for users of your product or the company you work for.
For example: https://snyk.io/vuln/npm:eslint:20180222
This vulnerability could have caused a Regular Expression Denial of Service
💡 Finding:
In order to find potential vulnerabilities in your repo, you can either do
-
npm audit
— which should show you an output like the following image:
2) Github security policy can also notify you — something like the following image:
Today when I started working I had to deal with this error where acorn
and minimist
were being reported as security vulnerabilities.
🎉 Solution
Solution to this problem is in steps:-
📦 npm update
- This is the first thing you should do and it's the simplest one too.
- Run npm update — https://docs.npmjs.com/cli-commands/update.html
- Delete your package-lock.json file or for yarn users, delete your yarn.lock file. In an ideal world this would work, but there might be some dependency which does not follow semver and might get updated too.
- So a better solution here would be to only delete the lines corresponding to the vulnerable package in your package-lock.json(or yarn.lock) file.
- Run npm install again
In an ideal scenario, this should have upgraded your dependencies to the next semver version and those libraries might have already fixed the version of there transitive dependencies.
🔠npm audit
2. But if that did not fix your issue, which for minimist
did not fix for me, then follow the below mentioned steps:
2.1) To fix any dependency, you need to first know which npm package depends on that.
npm audit
This will tell you the packages which are vulnerable.
This tells me that minimist
is required by mkdirp
and that is required by mocha
A quick glance into package-lock.json can give you more information around the affected version.
In my case mocha(7.1.0) -> mkdirp(0.5.1) -> minimist(0.0.8) — the vulnerable version.
🔑 Resolutions key
3) And finally the fix was:
3.1) First npm install the non-vulnerable version, which in my case was 1.2.5
npm install minimist --save-dev
yarn
and npm
users
3.2) Add a resolutions
key in your package.json file
For npm
users, we need one more step for that resolutions key to work.
3.3) Use npm-force-resolutions
(https://www.npmjs.com/package/npm-force-resolutions)
3.4) After that run
npm install
That's it. That solves the dependency issues which can not be updated using either npm update or by uninstalling and reinstalling a new dependency.
To check if the dependency works correctly
npm ls minimist
This should give you an output the image below
⚠️ Disclaimer
If some packages are only compatible with an older version, then this change might break your app. So be careful while resolving to a particular version and test your app before releasing this change.
👯 Give this article a clap if you found it helpful!
You can follow me on twitter @VivekNayyar09 for more updates. I work at Qoala App
Also please don't forget to maintain social distance to prevent the virus from spreading and wash your hands regularly. Stay safe and stay at home.
About Qoala
Asuransi
Asuransi adalah perjanjian antara perusahaan asuransi dan pemegang polis yang menjadi dasar bagi penerimaan premi oleh perusahaan asuransi sebagai imbalan untuk :
a. memberikan penggantian kepada tertanggung atau pemegang polis karena kerugian, kerusakan, biaya yang timbul, kehilangan keuntungan, atau tanggung jawab hukum kepada pihak ketiga yang mungkin diderita tertanggung atau pemegang polis karena terjadinya suatu peristiwa yang tidak pasti;atau
b. memberikan pembayaran yang didasarkan meninggal atau hidupnya tertanggung dengan manfaat yang besarnya telah ditetapkan dan/atau didasarkan pada hasil pengelolaan dana.
Usaha perasuransian merupakan kegiatan usaha yang bergerak di bidang:
a. Jasa pertanggungan atau pengelolaan risiko.
b. Pertanggungan ulang risiko.
c. Pemasaran dan distribusi produk asuransi atau produk asuransi syariah.
d. Konsultasi dan keperantaraan asuransi, asuransi syariah, reasuransi, atau reasuransi syariah, atau
e. Penilai kerugian asuransi atau asuransi syariah.
Usaha perasuransian dilaksanakan oleh:
1. Perusahaan Asuransi:
a. Perusahaan Asuransi Umum, adalah perusahaan yang memberikan jasa pertanggungan risiko yang memberikan penggantian karena kerugian, kerusakan, biaya yang timbul, kehilangan keuntungan, atau tanggung jawab hukum kepada pihak ketiga yang mungkin diderita tertanggung atau pemegang polis karena terjadinya suatu peristiwa yang tidak pasti.
b. Perusahaan Asuransi Jiwa, adalah perusahaan yang memberikan jasa dalam penanggulangan risiko yang memberikan pembayaran kepada pemegang polis, tertanggung, atau pihak lain yang berhak dalam hal tertanggung meninggal dunia atau tetap hidup, atau pembayaran lain kepada pemegang polis, tertanggung, atau pihak lain yang berhak pada waktu tertentu yang diatur dalam perjanjian, yang besarnya telah ditetapkan dan/atau didasarkan pada hasil pengelolaan dana.
c. Perusahaan Reasuransi, adalah perusahaan yang memberikan jasa dalam pertanggungan ulang terhadap risiko yang dihadapi oleh Perusahaan Asuransi Kerugian, Perusahaan Asuransi Jiwa, Perusahaan Penjaminan, atau Perusahaan Reasuransi lainnya.
2. Penunjang Usaha Asuransi:
a. Perusahaan Pialang Asuransi, adalah perusahaan yang memberikan jasa keperantaraan dalam penutupan asuransi atau asuransi syariah dan penanganan penyelesaian ganti rugi asuransi dengan bertindak untuk kepentingan tertanggung.
b. Perusahaan Pialang Reasuransi, adalah perusahaan yang memberikan jasa keperantaraan dalam penempatan reasuransi dan penanganan penyelesaian ganti rugi reasuransi dengan bertindak untuk kepentingan perusahaan asuransi, perusahaan penjaminan, perusahaan reasuransi.
c. Perusahaan Penilai Kerugian Asuransi, adalah perusahaan yang memberikan jasa penilaian terhadap klaim dan/atau jasa konsultasi atas obyek asuransi yang dipertanggungkan.
washingtonanythincel.blogspot.com
Source: https://itnext.io/fixing-security-vulnerabilities-in-npm-dependencies-in-less-than-3-mins-a53af735261d
0 Response to "After Npm Install save Must Install Be Run Again"
Post a Comment