在使用npx create-react-app的安装过程中出现了
6 high severity vulnerabilities
但是后续仍然显示成功安装,按照提示输入npm-audit时候却报错
npm audit fix
npm ERR! code ENOLOCK
npm ERR! audit This command requires an existing lockfile.
npm ERR! audit Try creating one first with: npm i --package-lock-only
npm ERR! audit Original error: loadVirtual requires existing shrinkwrap file
npm ERR! A complete log of this run can be found in:
npm ERR! C:\Users\christine\AppData\Local\npm-cache\_logs\2022-10-10T08_34_39_142Z-debug-0.log
后续发现是自己把项目的路径输错了,正确输入项目路径时显示提示漏洞的原因
nth-check <2.0.1
Severity: high
Inefficient Regular Expression Complexity in nth-check - https://github.com/advisories/GHSA-rp65-9cf3-cjxr
fix available via `npm audit fix --force`
Will install react-scripts@2.1.3, which is a breaking change
node_modules/svgo/node_modules/nth-check
css-select <=3.1.0
Depends on vulnerable versions of nth-check
node_modules/svgo/node_modules/css-select
svgo 1.0.0 - 1.3.2
Depends on vulnerable versions of css-select
node_modules/svgo
@svgr/plugin-svgo <=5.5.0
Depends on vulnerable versions of svgo
node_modules/@svgr/plugin-svgo
@svgr/webpack 4.0.0 - 5.5.0
Depends on vulnerable versions of @svgr/plugin-svgo
node_modules/@svgr/webpack
react-scripts >=2.1.4
Depends on vulnerable versions of @svgr/webpack
node_modules/react-scripts
6 high severity vulnerabilities
一个建议:忽略
npm提示可以使用`npm audit fix --force`进行修复,但是Don't be alarmed by vulnerabilities after NPM Install (voitanos.io)j
建议是忽略这些错误;因为npm只是包管理工具,他不能够解决包自身的缺陷和漏洞,如果强制修复解决的话,很有可能会引起更为严重的错误。
一定要尝试解决的话
打开项目中的package.json文件,找到dependencies对象
"dependencies":{
//……}
将其中的react.json移动到devDependencies(没有的话可以自己创建一个),你的版本可能与我的不同,但是这是无关紧要的,只需要移动即可
"devDependencies": {
"react-scripts": "5.0.1"
},
最后,在终端中运行npm audit --production,即可修复警告