Fixing npm security vulnerabilities can be daunting but isn't too difficult. These steps should get you through most fixes. This process will work for both npm and yarn setups (just change the commands).
- Perform an audit to figure out what packages are causing the vulnerabilities
npm audit
- The audit will show the affected packages.
- Add the packages and versions to the
package.json. Make sure to use the right version numbers
{
"resolutions": {
"package-name": "^3.2.1",
"other-package": "^1.2.3"
}
}
- Then add this to the
package.json.- Review the package documentation.
- If you're using yarn, check yarn's selective dependency resolutions
{
"scripts": {
"preinstall": "npx npm-force-resolutions"
}
}