title: Unable to fix package vulnerability (svg-sprite-loader)
body: <p><em><strong>Edit 3:</strong></em> Not sure what the takeaway here is - that it's a problem with the package, or something that I'm doing when trying to fix it. Would appreciate knowing if anyone has managed to install the dependencies from my <code>package.json</code> <em>without</em> any problems</p>
  <p><em><strong>Edit 2:</strong></em> Installing the same packages on another machine leads to only 2 vulnerabilities, but again, they appear to not be fixable. NPM only recommends manual review this time, rather than <code>npm audit fix --force</code>. <code>svg-sprite-loader</code> still seems to be the culprit though.</p>
  <pre><code>                                 Manual Review                                  
               Some vulnerabilities require your attention to resolve             
                                                                                  
            Visit https://go.npm.me/audit-guide for additional guidance           
  
  
    Moderate        Regular Expression Denial of Service in postcss               
  
    Package         postcss                                                       
  
    Patched in      &gt;=7.0.36                                                      
  
    Dependency of   svg-sprite-loader [dev]                                       
  
    Path            svg-sprite-loader &gt; svg-baker &gt; postcss                       
  
    More info       https://github.com/advisories/GHSA-566m-qj78-rww5             
  
  
    Moderate        Regular Expression Denial of Service in postcss               
  
    Package         postcss                                                       
  
    Patched in      &gt;=7.0.36                                                      
  
    Dependency of   svg-sprite-loader [dev]                                       
  
    Path            svg-sprite-loader &gt; svg-baker-runtime &gt; svg-baker &gt; postcss
  
    More info       https://github.com/advisories/GHSA-566m-qj78-rww5
  
  found 2 moderate severity vulnerabilities in 459 scanned packages
    2 vulnerabilities require manual review. See the full report for details.
  </code></pre>
  <p><em><strong>Edit:</strong></em> Am also open to ditching svg-sprite-loader entirely if someone has suggestions</p>
  <p>Running <code>npm audit</code> finds 4 vulnerabilities and suggests forcing a breaking change to <code>svg-sprite-loader</code> (reverting it from v6 back to v2??).</p>
  <p>That fixes one vulnerability, but the remaining 3 don't seem to be affected by running <code>npm audit fix</code> as suggested. I'm at a loss how to fix it.</p>
  <pre><code>npm: 8.10.0
  Node: 16.14.0
  webpack: 5.72.1
  svg-sprite-loader: 6.0.11
  </code></pre>
  <p>The audit report before running <code>npm audit fix --force</code>:</p>
  <pre><code>postcss  &lt;7.0.36
  Severity: moderate
  Regular Expression Denial of Service in postcss - https://github.com/advisories/GHSA-566m-qj78-rww5
  fix available via `npm audit fix --force`
  Will install svg-sprite-loader@2.0.3, which is a breaking change
  node_modules/postcss
    svg-baker  &gt;=1.2.5
    Depends on vulnerable versions of postcss
    node_modules/svg-baker
      svg-baker-runtime  &gt;=1.4.0-alpha.10475b37
      Depends on vulnerable versions of svg-baker
      node_modules/svg-baker-runtime
        svg-sprite-loader  &gt;=2.0.4
        Depends on vulnerable versions of svg-baker
        Depends on vulnerable versions of svg-baker-runtime
        node_modules/svg-sprite-loader
  
  4 moderate severity vulnerabilities
  </code></pre>
  <p>The report after <code>npm audit fix --force</code></p>
  <pre><code>postcss  &lt;7.0.36
  Severity: moderate
  Regular Expression Denial of Service in postcss - https://github.com/advisories/GHSA-566m-qj78-rww5
  fix available via `npm audit fix`
  node_modules/postcss
    svg-baker  &gt;=1.2.5
    Depends on vulnerable versions of postcss
    node_modules/svg-baker
      svg-baker-runtime  &gt;=1.4.0-alpha.10475b37
      Depends on vulnerable versions of svg-baker
      node_modules/svg-baker-runtime
  
  3 moderate severity vulnerabilities
  </code></pre>
  <p>Running <code>npm audit fix</code> doesn't fix those vulnerabilites, and I don't really know how to deal with them. Would appreciate someone taking a look who might understand the problem better than I do</p>
  <p>**<em><strong>Edit:</strong></em></p>
  <p>package.json before fix</p>
  <pre><code>{
    &quot;name&quot;: &quot;vanilla-template&quot;,
    &quot;version&quot;: &quot;1.0.0&quot;,
    &quot;description&quot;: &quot;&quot;,
    &quot;main&quot;: &quot;index.js&quot;,
    &quot;scripts&quot;: {
      &quot;test&quot;: &quot;echo \&quot;Error: no test specified\&quot; &amp;&amp; exit 1&quot;
    },
    &quot;author&quot;: &quot;&quot;,
    &quot;license&quot;: &quot;ISC&quot;,
    &quot;devDependencies&quot;: {
      &quot;html-webpack-plugin&quot;: &quot;^5.5.0&quot;,
      &quot;svg-sprite-loader&quot;: &quot;^6.0.11&quot;,
      &quot;webpack&quot;: &quot;^5.72.1&quot;,
      &quot;webpack-dev-server&quot;: &quot;^4.9.0&quot;
    }
  }
  </code></pre>
  <p>package.json after fix</p>
  <pre><code>{
    &quot;name&quot;: &quot;vanilla-template&quot;,
    &quot;version&quot;: &quot;1.0.0&quot;,
    &quot;description&quot;: &quot;&quot;,
    &quot;main&quot;: &quot;index.js&quot;,
    &quot;scripts&quot;: {
      &quot;test&quot;: &quot;echo \&quot;Error: no test specified\&quot; &amp;&amp; exit 1&quot;
    },
    &quot;author&quot;: &quot;&quot;,
    &quot;license&quot;: &quot;ISC&quot;,
    &quot;devDependencies&quot;: {
      &quot;html-webpack-plugin&quot;: &quot;^5.5.0&quot;,
      &quot;svg-sprite-loader&quot;: &quot;^2.0.3&quot;,
      &quot;webpack&quot;: &quot;^5.72.1&quot;,
      &quot;webpack-dev-server&quot;: &quot;^4.9.0&quot;
    }
  }
  </code></pre>