Repository navigation
NPM Audit Failure = @angular-devkit/build-angular #14138
Description
🐞 Bug report
Command (mark with an x)
- [ X ] new
- build
- serve
- test
- e2e
- generate
- add
- update
- lint
- xi18n
- run
- config
- help
- version
- doc
### Is this a regression?
no
### Description
Up to date NG CLI, creating a new project, npm audit strikes
## 🔬 Minimal Reproduction
Up to date NG CLI, creating a new project, npm audit strikes
## 🔥 Exception or Error
<pre><code>
┌──────────────────────────────────────────────────────────────────────────────┐
│ Manual Review │
│ Some vulnerabilities require your attention to resolve │
│ │
│ Visit https://go.npm.me/audit-guide for additional guidance │
└──────────────────────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ High │ Arbitrary File Overwrite │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ tar │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.4.2 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ @angular-devkit/build-angular [dev] │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ @angular-devkit/build-angular > node-sass > node-gyp > tar │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://npmjs.com/advisories/803 │
└───────────────┴──────────────────────────────────────────────────────────────┘
</code></pre>
## 🌍 Your Environment
<pre><code>
Angular CLI: 7.3.8
Node: 10.15.0
OS: darwin x64
Angular:
...
Package Version
------------------------------------------------------
@angular-devkit/architect 0.13.8
@angular-devkit/core 7.3.8
@angular-devkit/schematics 7.3.8
@schematics/angular 7.3.8
@schematics/update 0.13.8
rxjs 6.3.3
typescript 3.2.4
</code></pre>
**Anything else relevant?**
Nothing further
Activity
alan-agius4 commentedon Apr 11, 2019
Hi, thanks for reporting this, however this is caused by an upstream package and will be fixed when they release a new version nodejs/node-gyp#1714
spp125 commentedon Apr 11, 2019
I am having the same issue.
cap-akimrey commentedon Apr 11, 2019
v4.4.8 was just released.
chet-manley commentedon Apr 11, 2019
Looks like node-gyp already took care of it.
nodejs/node-gyp#1713
Adam-Kernig commentedon Apr 12, 2019
Im guessing with it now being resolved we can expect this in the next release?
HansITChange commentedon Apr 12, 2019
Building a new app still generates the same error
alan-agius4 commentedon Apr 12, 2019
node-sassare using an older version ofnode-gyp. hence we are still blocked on this.See: sass/node-sass#2625
ignaciorecuerda commentedon Apr 12, 2019
This question has already been answered. Can you try this solution https://stackoverflow.com/a/55649551/10961281, it has worked for me
Adam-Kernig commentedon Apr 12, 2019
Do NOT manually edit the lock file.
Adam-Kernig commentedon Apr 12, 2019
Wait till sass is updated and give the angular chaps time, it's friday (for us anyway) We aren't releasing this weekend.
The Angular guys are extremely quick at resolving issues, patience is key.
Fix issue #114
32 remaining items
alan-agius4 commentedon May 16, 2019
Closing the issue as this seems to have been fixed upstream without the need to do any changes from our side.
pl4yradam commentedon May 16, 2019
franciscojsr commentedon May 16, 2019
Yes! I just did:
npm audit fixand solved!subhashkonda commentedon May 16, 2019
Npm audit fix fixed all issues in my local, but I still see in my CI build showing the tar 2.2.2 high vulnerability. Do you see the issue is still open or is this seems to be my CI Build specific.
Does anyone facing the same ?
ShahanaFarooqui commentedon May 17, 2019
@subhashkonda i am also facing the same issue with github. Veulnerability fixed on my local but Github still shows it vulnerable. They might need some more time to update their audit list :).
xaviergxf commentedon May 17, 2019
@alan-agius4 do you know when the dependency will be updated, and a new version of @angular-devkit/build-angular will be released on version 7 (stable)?
salah3x commentedon May 17, 2019
@xaviergxf, I don't think they need a new release for this issue since it's been fixed upstream.
alan-agius4 commentedon May 18, 2019
Indeed no release is needed from our side.
weidenhaus commentedon May 27, 2019
27 May 2019 - Still facing the same issue when creating new Angular project via CLI - 12 high vulnerabilities found.
The following solved it for me:
subhashkonda commentedon Jun 6, 2019
I still have this same issue in CI Builds but in local it is all fine npm audit gives 0 vulnerabilities, So what can be done here???
angular-automatic-lock-bot commentedon Sep 9, 2019
This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.
Read more about our automatic conversation locking policy.
This action has been performed automatically by a bot.