High Security Vulnerabilities - Audit does not fix

Question

please help me with the below situation.

I have an Angular project :

ng version :

Angular CLI: 17.1.0
Node: 20.8.0
Package Manager: npm 10.1.0
OS: win32 x64

Angular: 17.1.0
... animations, cdk, cli, common, compiler, compiler-cli, core
... forms, material, platform-browser, platform-browser-dynamic
... router

Package                         Version
---------------------------------------------------------
@angular-devkit/architect       0.1701.0
@angular-devkit/build-angular   17.1.0
@angular-devkit/core            17.1.0
@angular-devkit/schematics      17.1.0
@schematics/angular             17.1.0
rxjs                            7.8.1
typescript                      5.3.3
zone.js                         0.14.3

And when I try to install the : jsonwebtoken package, I'm receiving the below errors:

up to date, audited 977 packages in 5s

116 packages are looking for funding
  run `npm fund` for details

2 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details

npm audit fix =>

# npm audit report

vite  5.0.0 - 5.0.11
Severity: high
Vite dev server option `server.fs.deny` can be bypassed when hosted on case-insensitive filesystem - https://github.com/advisories/GHSA-c24v-8rfc-w8vw
fix available via `npm audit fix --force`
Will install @angular-devkit/[email protected], which is a breaking change
node_modules/vite
  @angular-devkit/build-angular  >=17.1.0-next.0
  Depends on vulnerable versions of vite
  node_modules/@angular-devkit/build-angular

2 high severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Please help me with this situation.

Thank you!

Update: The jsonwebtoken can be installed fine on angular 15.2.10. I've tried on 16.2.4 and it shows the same security vulnearbilities as mentioned above.

Answer 1

As @possum suggested, @angular-devkit/build-angular is dependent explicitly on 5.0.4. What you can do to get around this, is create an 'overrides' section in your package.json which explicitly forces dependencies to use a specific version of a package. Add this to your package.json:

"overrides": {
    "vite": "5.1.5"
  }

..then run npm i and then npm audit, it should show no vulnerabilities. You can limit this to a specific dependency name too:

{
  "overrides": {
    "@angular-devkit/build-angular": {
      "vite": "5.1.5"
    }
  }
}

In the long term though, it's better practice to keep upgrading as the version of @angular-devkit/build-angular becomes more mature and the Angular team address these vulnerabilities, so you don't have to rely on overrides.

More information on overrides here