如何通过人工审核修复这些漏洞？

Question

I did npm audit and npm audit fix .

But some vulnerabilities needs manual review.

So, How to upgrade these packgaes by manually? These packages needs manual upgrade.

Answer 1

The audit command will install semver-major updates when the --force flag is used. This is not default behavior because it may introduce breaking changes in updated dependencies.

npm audit fix --force

Alternatively, you can manually update a specific dependency with an install command.

npm install uglifyjs-webpack-plugin@latest --save-dev 

In this particular case, uglifyjs-webpack-plugin is deprecated and suggests terser-webpack-plugin as an alternative. You may want to use that package instead.

npm uninstall uglifyjs-webpack-plugin --save-dev
npm install terser-webpack-plugin --save-dev