preact-cli具有高度严重的漏洞，npm审计修复循环运行(3.0.5 <-> 2.2.1)

Question

我正在用preact -cli建立一个预演项目：

npx --version # 7.4.0
npx preact-cli create typescript frontend

这告诉我：

...
added 1947 packages, and audited 1948 packages in 31s

129 packages are looking for funding
  run `npm fund` for details

3 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.
✔ Done!

3仅运行默认设置后的高安全性漏洞！？

听起来不太放心。

npm audit fix

...
fix available via `npm audit fix --force`
Will install preact-cli@2.2.1, which is a breaking change

好的，那么很明显npm的修正想要降级前-cli。那我们走吧：

npm audit fix --force

...

fix available via `npm audit fix --force`
Will install preact-cli@3.0.5, which is a breaking change
node_modules/preact-cli/node_modules/webpack-dev-server/node_modules/yargs-parser
node_modules/preact-cli/node_modules/yargs-parser
  yargs  4.0.0-alpha1 - 12.0.5 || 14.1.0 || 15.0.0 - 15.2.0
  Depends on vulnerable versions of os-locale
  Depends on vulnerable versions of yargs-parser
  node_modules/preact-cli/node_modules/webpack-dev-server/node_modules/yargs
  node_modules/preact-cli/node_modules/yargs
    preact-cli  1.0.0 - 3.0.0-next.3
    Depends on vulnerable versions of extract-text-webpack-plugin
    Depends on vulnerable versions of url-loader
    Depends on vulnerable versions of yargs
    node_modules/preact-cli
    webpack  2.1.0-beta.8 - 4.0.0-alpha.0
    Depends on vulnerable versions of yargs
    node_modules/preact-cli/node_modules/webpack
      extract-text-webpack-plugin  2.0.0-beta.0 - 3.0.2
      Depends on vulnerable versions of webpack
      node_modules/preact-cli/node_modules/extract-text-webpack-plugin
      webpack-dev-server  2.0.0-beta - 3.10.3
      Depends on vulnerable versions of webpack
      Depends on vulnerable versions of yargs
      node_modules/preact-cli/node_modules/webpack-dev-server

17 vulnerabilities (7 low, 8 moderate, 2 high)

啊，是的，降级到2.2.1带来了新的漏洞。这些问题可以通过取消降级并恢复到3.0.5来解决。

这是一个循环，npm审计修复-强制只是在3.0.5和2.2.1版本的preact-cli之间来回切换。

一些上下文：，这似乎是一个已知的问题。

Answer 1

在这里晚些时候( CLI已经关闭了)，但是对于上下文，2.2.1已经有几年的历史了，并且依赖关系是构建时的依赖。构建时间依赖没有风险，尤其是这个，因为它只是用来报告构建的包大小的变化。

总是看看npm audit到底在抱怨什么。如果它只是构建时间，你可以忽略它。