0
35
ViewsVulnerability in NestJS 8.4.5
Recently, when I run npm audit in my npm package, I receive the following error:
The problem seems to be in the dicer package which is a very popular package used by NestJS.
I searched the web for possible solutions but can't find any fixes. Has anyone been able to fix this yet?
Thanks in advance.
Juan Pablo Isaza
3 answers
Answer question0
Has anyone been able to fix this yet?
No, or at least not in a published form. A fix for the dicer bug is not available. The URL in the picture of the text you included says that.
NPM is offering to downgrade nestjs/core to a version that doesn't depend on it. That will fix the issue (although probably create others).
Looking at the Github page for dice shows a bug report where you can get upto date information about the state of any fix.
0
Found a temporary solution until it will be fixed by devs, by using overrides - all honors to @hiagodotme
- Delete package-lock.json & node_modules
- Provide overrides for multer in package.json ( npm 8.x )
"overrides": {
"multer": "^1.4.4-lts.1"
},
- Re-install modules
0
It seems that NestJS has fixed it by removing dicer from their packages. I fixed the issue just by deleting the package-lock.json and node_modules folder and running npm install again.