-
-
Notifications
You must be signed in to change notification settings - Fork 542
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
express-generator
app uses modules which have critical security vulnerabilities
#327
Comments
Even after following https://stackoverflow.com/questions/57923270/vulnerabilities-problem-using-npm-install |
This comment was marked as resolved.
This comment was marked as resolved.
Yes that would be much better. |
No worries @RushilJalal Thank you for reporting this. |
Is it possible to assign this issue to me? |
Sure @RushilJalal |
//cmd.js
it('should have a package.json file', function () {
var file = path.resolve(ctx.dir, 'package.json')
var contents = fs.readFileSync(file, 'utf8')
assert.strictEqual(contents, '{\n' +
' "name": "express-1-no-args",\n' +
' "version": "0.0.0",\n' +
' "private": true,\n' +
' "scripts": {\n' +
' "start": "node ./bin/www"\n' +
' },\n' +
' "dependencies": {\n' +
' "cookie-parser": "~1.4.5",\n' +
' "debug": "~2.6.9",\n' +
' "express": "~4.17.1",\n' +
' "http-errors": "~1.7.2",\n' +
//replace default jade with pug
// ' "jade": "~1.11.0",\n' +
' "pug": "~3.0.3",\n' +
' "morgan": "~1.10.0"\n' +
' }\n' +
'}\n')
}) //express-cli.js
// Default view engine
if (options.view === true) {
warning('the default view engine will not be jade in future releases\n' +
"use `--view=jade' or `--help' for additional options")
options.view = 'pug'//changed jade to pug
} I have made the changes as highlighted in the comment. |
@IamLizu Kindly advise... |
I created an app using
express-generator
and on runningnpm i
i am told that some of the modules have high and several critical level security vulnerabilities.I ran
npm audit fix --force
which still didn't fix the problem.I referred https://stackoverflow.com/questions/57923270/vulnerabilities-problem-using-npm-install which asked to uninstall
jade
and installpug
instead which fixed the issue.I believe this should be inbuilt and the user should not be required to manually install
pug
.The text was updated successfully, but these errors were encountered: