[Security] Nexus Q Check Package Dependency Failed

[tistisman]

It's Threat Policy is high,

Is there a way to Resolved this issue ?

[sdepold]

Is that tool suggesting that @types/node is vulnerable? https://security.snyk.io/package/npm/@types%2Fnode/18.11.4

[sdepold]

@tistisman furthermore, I would always suggest to check projects' documentation first to see if there is Responsible Disclosure Policy

[ephys]

Marking @types/node as vulnerable sounds super weird to me. Isn't it just typing definitions?

Still wkx requires "@types/node": "*", so npm audit fix should resolve this

[WikiRik]

Unless more information is provided it seems like this is an error in Sonatype's Nexus IQ Server giving a false positive. Other similar tools and website do not give active vulnerabilities in @types/node.

In order to not cause confusion I will close this issue.

[tistisman]

@WikiRik
@ephys
@sdepold

My Bad
I think this was fixed in the latest version.

sorry for super late reply,
I just recently found that the issue got replied.