安装egg-bin报错，始终不能安装成功

[huturen]

安装egg-bin报错，始终不能安装成功

➜ npm i egg-bin --save-dev
npm WARN ERESOLVE overriding peer dependency
npm WARN Found: mocha@6.2.3
npm WARN node_modules/mocha
npm WARN   mocha@"^6.0.2" from egg-bin@4.16.2
npm WARN   node_modules/egg-bin
npm WARN     dev egg-bin@"^4.11.0" from the root project
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer mocha@">=1.18 <6" from co-mocha@1.2.2
npm WARN node_modules/co-mocha
npm WARN   co-mocha@"^1.2.2" from egg-bin@4.16.2
npm WARN   node_modules/egg-bin
npm ERR! code ERESOLVE
npm ERR! ERESOLVE unable to resolve dependency tree
npm ERR!
npm ERR! Found: chokidar@2.1.8
npm ERR! node_modules/chokidar
npm ERR!   chokidar@"^2.0.1" from egg-ts-helper@1.25.9
npm ERR!   node_modules/egg-ts-helper
npm ERR!     egg-ts-helper@"^1.25.2" from egg-bin@4.16.2
npm ERR!     node_modules/egg-bin
npm ERR!       dev egg-bin@"^4.11.0" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peerOptional chokidar@"^3.3.0" from nunjucks@3.2.3
npm ERR! node_modules/nunjucks
npm ERR!   nunjucks@"^3.1.3" from egg-ci@1.18.0
npm ERR!   node_modules/egg-ci
npm ERR!     dev egg-ci@"^1.11.0" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR!
npm ERR! See /Users/hu/.npm/eresolve-report.txt for a full report.

npm ERR! A complete log of this run can be found in:
npm ERR!     /Users/hu/.npm/_logs/2021-06-08T13_11_00_651Z-debug.log

node环境如下

➜ node -v
v14.15.1
➜ npm -v
7.9.0

官方的sample项目也会报错

链接： https://eggjs.org/zh-cn/intro/quickstart.html

执行完 npm init egg --type=simple 后
再执行 npm i

也会报上面的错误。

[hyj1991]

试试看 npm i egg-bin --save-dev --legacy-peer-deps

[atian25]

@hyj1991 有空帮忙升级下 egg-bin 的依赖？

[hyj1991]

看起来是由 npm7 的一个 break-change 引起的：

另一个办法是可以安装 npm v6 来进行安装：npm i npm@latest-6 -g

而且我建议你试下将 registry 指向官方的源再试下 npm 7 来安装: npm set registry https://registry.npmjs.org

[hyj1991]

@hyj1991 有空帮忙升级下 egg-bin 的依赖？

ok

[huturen]

试试看 npm i egg-bin --save-dev --legacy-peer-deps

@hyj1991 按照这个方式，解决了，并安装成功。

不过，安装成功后，会报：22 vulnerabilities (9 low, 10 moderate, 2 high, 1 critical)

详细输出如下：

➜ install --legacy-peer-deps
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated mkdirp@0.5.4: Legacy versions of mkdirp are no longer supported. Please update to mkdirp 1.x. (Note that the API surface has changed to use Promises in 1.x.)
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated debug@3.2.6: Debug versions >=3.2.0 <3.2.7 || >=4 <4.3.1 have a low-severity ReDos regression when used in a Node.js environment. It is recommended you upgrade to 3.2.7 or 4.3.1. (https://github.com/visionmedia/debug/issues/797)
npm WARN deprecated fsevents@1.2.13: fsevents 1 will break on node v14+ and could be using insecure binaries. Upgrade to fsevents 2.
npm WARN deprecated chokidar@2.1.8: Chokidar 2 will break on node v14+. Upgrade to chokidar 3 with 15x less dependencies.
npm WARN deprecated core-js@2.6.12: core-js@<3 is no longer maintained and not recommended for usage due to the number of issues. Please, upgrade your dependencies to the actual version of core-js@3.

added 1190 packages, and audited 1328 packages in 28s

57 packages are looking for funding
  run `npm fund` for details

22 vulnerabilities (9 low, 10 moderate, 2 high, 1 critical)

To address issues that do not require attention, run:
  npm audit fix

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

[hyj1991]

不过，安装成功后，会报：22 vulnerabilities (9 low, 10 moderate, 2 high, 1 critical)

这是依赖的依赖或者依赖的依赖的依赖有安全漏洞，由于 egg-bin 本身只是在开发模式下运行，所以无需关注。

[dennisleung]

不过，安装成功后，会报：22 vulnerabilities (9 low, 10 moderate, 2 high, 1 critical)

这是依赖的依赖或者依赖的依赖的依赖有安全漏洞，由于 egg-bin 本身只是在开发模式下运行，所以无需关注。

chokidar@2.x在node 14下不是有问题吗？还是需要升级下的吧。。我看egg-ts-helper都有个升级的pr挂了一年多了还没合入。。

[whxaxes]

@dennisleung 我来处理一下

[dennisleung]

@dennisleung 我来处理一下

辛苦大佬，请问有预计修复的时间吗？egg对glob-parent这个包的依赖挺多的，目前这个包被爆出有安全问题：
http://new.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-202107-1558

[smadey]

@dennisleung 我来处理一下

有进度更新么？