audit failure 81 vulnerabilities found

[krishnaTORQUE]

Describe the bug

vulnerabilities found

Audit

┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ postcss │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=8.2.10 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-scripts > resolve-url-loader > postcss │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1693 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ browserslist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=4.16.5 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-scripts > react-dev-utils > browserslist │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1747 │
└───────────────┴──────────────────────────────────────────────────────────────┘
┌───────────────┬──────────────────────────────────────────────────────────────┐
│ moderate │ Regular Expression Denial of Service │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Package │ ws │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Patched in │ >=7.4.6 │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Dependency of │ react-scripts │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ Path │ react-scripts > webpack-dev-server > ws │
├───────────────┼──────────────────────────────────────────────────────────────┤
│ More info │ https://www.npmjs.com/advisories/1748 │
└───────────────┴──────────────────────────────────────────────────────────────┘
81 vulnerabilities found - Packages audited: 2746

[indignant]

Some other tickets already filed for this: #10929 #10945 #11007 #11012

[krishnaTORQUE]

so is there any fix coming soon or any pending PR for it?
If not then then I can make a PR to fix it.
Please do let me know

[indignant]

My understanding is there have been a couple of PRs submitted, some workarounds suggested, and some CRA team meetings on the subject; this is just what I was able to derive from the conversations in the existing tickets.

[xFrann]

Are those vulnerabilities a big deal for production?

[indignant]

@xFrann I don't think any of these are real vulnerabilities; they're tools to create the static bundle. It just breaks people's CI/CD flow when the flow runs npm audit.

[wmeints]

Still, it's kind of weird to leave a vulnerable package in your project. And 80 vulnerabilities is no fun at all. It sort of feels like they don't really care about security.

[toreylittlefield]

This is also a duplicate of #11012 I believe so I am watching the issue as well. Some useful comments in issues if you dig through it.

[murugavel-n]

I've an open PR #11036 to fix browserslist. Still waiting for review.

[gaearon]

See #11174.