CODEWITHSUNDEEP
securitygithubpackage.json
user1941537
user1941537

Reputation: 6695

How can I fix this GitHub security alert?

After pushing a new repo to GitHub I got this security alert from GitHub:

enter image description here

According to GitHub, the effected file is package-lock.json.

To fix the issue, I did this:

  1. Deleted the package-lock.json from remote repo on GitHub.
  2. Found and replace tar versions inside my local package-lock.json to >=4.4.2.
  3. Deleted node_modules folder from my local repo.
  4. Ran npm install
  5. Pushed package-lock.json to remote.

But it didn't help and I still get the same security alert from GitHub.

How can I fix this?

Upvotes: 7

Views: 6704

Answers (1)

Ben Blank
Ben Blank

Reputation: 56624

You should never need to delete or edit your package-lock.json manually. In this case, the file you want to edit is package.json (no -lock). Specifically:

  1. Open package.json in your favorite editor.
  2. Find the line for "tar": "…".
  3. Replace whatever is in the right-hand string with ">=4.4.2".
  4. Save the file and run npm install.
  5. Check in the changes to package.json and package-lock.json.
  6. Push to Github.

Upvotes: 2

Related Questions