Parcel-Bundler 无法修复高漏洞

Question

I followed Kevin Powell's YT video on SASS and Parcel. I manage to get the SASS part up and running fine and managed to get the parcel-bundler working on one project fine...so up to that point everything is ok.

Today I was creating a new project and followed all the required steps and when I got to installing Parcel via npm install parcel-bundler --save-dev I'm getting 2 high severity vulnerabilities....I've ran the npm audit fix command and the npm audit fix --force as suggested but no luck on getting rid of the issue.

Here's the output of the npm audit

npm audit report

node-forge  <=0.9.2
Severity: high
Prototype Pollution in node-forge - https://npmjs.com/advisories/1561
fix available via `npm audit fix --force`
Will install parcel-bundler@1.3.1, which is a breaking change
node_modules/node-forge
  parcel-bundler  >=1.4.0
  Depends on vulnerable versions of node-forge
  node_modules/parcel-bundler

2 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

I have tried all possible solutions that I could find on the issue, but for the life of me I can't get it to work.

I even did a test on both my PC and Laptop...my main PC is running Linux Mint 19.2 cinnamon and the laptop Window 10 and in both I get the same 2 vulnerabilities.

How can I fix this?

Answer 1

I had same issue this days. I tried everything possible, and only this worked

npm add --dev parcel@next

or

npm add --include=dev parcel@next

If they don't work try also with:

npm install -D parcel@next

Its version 2.0.0-beta.1

Also, I uninstall NodeJS, deleted users/{myName}/AppData/Roaming/npm directories, package.json, and node_modules.

Answer 2

Thanks @Stefan!

To summarize the steps I took to make it work was:

Deleted all pre-existing.json, node_modules, cache folders and even the dist folder intended to hold the bundled code (html, css, etc.) to make sure I had a clean slate to begin with.

Then I initialized npm:

npm init -y

After that I added 'Parcel':

npm add --include=dev parcel@next

I fixed any issues by forcing the fix and making sure there was no issues whatsoever:

npm audit fix --force

And now the sweet part...I just ran Yarn and voilá, it works!

yarn parcel index.html

• npm version: 7.6.3
• parcel version: 2.0.0-beta.1
• yarn version: 1.22.5

Answer 3

There is no need to worry about the vulnerabilities. You can just follow Kevin's steps in the video Sass with auto-refresh (and more) made easy

and it all works fine.

If you want to learn about the issue, check out this link, https://github.com/parcel-bundler/parcel/issues/5145

Look at the screenshot attached