npm audit failure (high severity) due to dns-packet

[entorenee]

Describe the bug

npm audit currently fails on react-scripts@4.0.3 due to a high security vulnerability in dns-packet. The dependency path is react-scripts > webpack-dev-server > bonjour > multicast-dns > dns-packet. The respective npm advisory is at https://www.npmjs.com/advisories/1745.

Screenshot of the particular audit failure.

Steps to reproduce

1. Run npm audit on react-scripts@4.0.3
2. Try to run npm audit fix
3. Confirm that the fix was not auto resolved.

Expected behavior

npm audit can exit successfuly.

Actual behavior

npm audit fails

[Primajin]

Yeah there are currently 8 Issues via dependencies: https://snyk.io/test/npm/react-scripts/4.0.3
This other high severity issue is via lodash.template - I hope we can fix these issues asap 🤞🏻

[stahlmanDesign]

Yeah there are currently 8 Issues via dependencies: https://snyk.io/test/npm/react-scripts/4.0.3
This other high severity issue is via lodash.template - I hope we can fix these issues asap 🤞🏻

Luckily the lodash patch can be fixed with npm audit fix, whereas the dns-packet issue cannot (a more complex dependency?). So the dns-packet fix is more urgent, although yes would be nice to get all the patches if it doesn't slow down the release

[stahlmanDesign]

npm audit fix now updates dns-packet #11012 (comment)

[Primajin]

I can confirm that npm audit fix fixes the high severity issue with dns-packet.
However there are still 80 moderate vulnerabilities though.

[Koonstaantiin]

Could you suggest please how to fix this error with yarn?

[MengRS]

Yeah there are currently 8 Issues via dependencies: https://snyk.io/test/npm/react-scripts/4.0.3
This other high severity issue is via lodash.template - I hope we can fix these issues asap 🤞🏻

Luckily the lodash patch can be fixed with npm audit fix, whereas the dns-packet issue cannot (a more complex dependency?). So the dns-packet fix is more urgent, although yes would be nice to get all the patches if it doesn't slow down the release

@stahlmanDesign - npm audit fix does not fix the lodash.template issue for me in snyk... can you confirm it did for you?

using snyk:

[stahlmanDesign]

npm-audit-output.txt
@MengRS See my npm audit output. Found 10 vulnerabilities (1 low, 5 moderate, 4 high), no lodash issues

[gaearon]

Please see #11174.