NPM: cldr -> 4 low severity vulnerabilities

[Laurin S]

# npm audit report

minimist  <0.2.1 || >=1.0.0 <1.2.3

Prototype Pollution - https://npmjs.com/advisories/1179

No fix available

node_modules/mkdirp/node_modules/minimist

  mkdirp  0.4.1 - 0.5.1

  Depends on vulnerable versions of minimist

  node_modules/mkdirp

    cldr-data-downloader  *

    Depends on vulnerable versions of mkdirp

    node_modules/cldr-data-downloader

      cldr-data  *

      Depends on vulnerable versions of cldr-data-downloader

      node_modules/cldr-data

4 low severity vulnerabilities

Any idea?

dependency: "cldr-data": "^36.0.0",

[Jesus Arockia Sankaran S]

Hi Laurin, 

Sorry for the inconvenience.  

We have checked the reported issue and we suspect that it is not from Syncfusion packages. This vulnerability issue comes from the “cldr-data” NPM package. However, we request you to check the below blog post for more details.  

Blog: https://itnext.io/fixing-security-vulnerabilities-in-npm-dependencies-in-less-than-3-mins-a53af735261d 

Below configuration in package.json file fixes the reported issue.  

"scripts": { 

    "preinstall": "npx npm-force-resolutions" 

  }, 

  "resolutions": { 

    "minimist": "^1.2.5" 

  }, 

  "dependencies": { 

    "cldr-data": "^36.0.0" 

  } 

Reference Image: 

 

 

Please get back to us if you have any queries. 

Regards, 

Jesus Arockia Sankaran S