title: Fixing NPM vulnerabilities
body: <p>I am following a TypeScript tutorial. Unfortunately, the packages are outdated and I got a warning about vulnerabilities.</p>
  <p>I followed a bunch of suggestions from <a href="https://stackoverflow.com/questions/16525430/npm-check-and-update-package-if-needed">npm check and update package if needed</a>, namely:</p>
  <pre><code>npm audit fix
  npm audit fix --force
  npm update
  </code></pre>
  <p><code>npm audit</code> says there are still 24 vulnerabilities left. But none of the above commands will fix them.</p>
  <p><code>npm outdated</code> results in no output.</p>
  <p>The vulnerable packages are:</p>
  <pre><code>ansi-regex
  glob-parent
  node-forge
  nth-check
  postcss
  </code></pre>
  <p>I don't actually know why they are part of my project, I don't have them in my <code>package.json</code> configuration.</p>
  <p>What are the next steps of fixing these vulnerabilities?</p>
  <p>I have tried:</p>
  <ul>
  <li><a href="https://stackoverflow.com/questions/67679757/how-to-fix-npm-vulnerabilities">How to fix npm vulnerabilities?</a>
  which has no answers.</li>
  <li>updating the dependencies in <code>package.json</code> manually to newer versions and then running <code>npm install</code>. It didn't have an effect.</li>
  <li>deleting <code>package-lock.json</code> according to a suggestion <a href="https://itnext.io/fixing-security-vulnerabilities-in-npm-dependencies-in-less-than-3-mins-a53af735261d" rel="nofollow noreferrer">here</a> and then run <code>npm install</code> again.</li>
  <li>adding <code>&quot;ansi-regex&quot;: &quot;^6.0.1&quot;, &quot;glob-parent&quot;: &quot;^6.0.2&quot;, &quot;node-forge&quot;: &quot;^1.3.0&quot;, &quot;nth-check&quot;: &quot;^2.0.1&quot;, &quot;postcss&quot;: &quot;^8.4.12&quot;</code> as as devDependencies and running <code>npm install</code>.</li>
  <li>running <code>npm i npm@latest</code> as suggested in <a href="https://stackoverflow.com/questions/67697844/how-to-fix-npm-vulnerabilities">How to fix NPM vulnerabilities</a></li>
  <li><a href="https://stackoverflow.com/questions/68172407/how-to-fix-npm-vulnerabilities-i-tried-two-methods-problems-persist">How to fix npm vulnerabilities? I tried two methods, problems persist</a> which didn't have any new suggestions</li>
  <li><a href="https://stackoverflow.com/questions/69030314/i-have-5-moderate-severity-vulnerabilities-when-i-checked-the-npm-audit-how-can">I have 5 moderate severity vulnerabilities when I checked the npm audit. How can I fix these errors given below?</a> which also didn't suggest any new commands</li>
  <li>running <code>npm update glob-parent --depth 2</code> just to find out that <code>--depth</code> is deprecated and NPM always <a href="https://github.com/npm/rfcs/blob/main/implemented/0019-remove-update-depth-option.md" rel="nofollow noreferrer">updates any depth [Github]</a></li>
  <li>running <code>npm prune</code></li>
  <li>deleting the <code>node_modules</code> folder and running <code>npm install</code> again</li>
  </ul>
  <p>You can reproduce my latest state with the following <code>package.json</code> in an empty directory and running <code>npm install</code>.</p>
  <pre class="lang-json prettyprint-override"><code>{
    &quot;name&quot;: &quot;pacman&quot;,
    &quot;version&quot;: &quot;0.0.1&quot;,
    &quot;description&quot;: &quot;I just follow a tutorial. Nothing of interest.&quot;,
    &quot;keywords&quot;: [&quot;game&quot;],
    &quot;license&quot;: &quot;MIT&quot;,
    &quot;author&quot;: &quot;someone stupid&quot;,
    &quot;scripts&quot;: {
      &quot;build&quot;: &quot;parcel build index.html&quot;,
      &quot;dev&quot;: &quot;parcel index.html --open&quot;,
      &quot;start&quot;: &quot;npm run build &amp;&amp; npm run dev&quot;,
      &quot;test&quot;: &quot;echo \&quot;Error: no test specified\&quot; &amp;&amp; exit 1&quot;
    },
    &quot;devDependencies&quot;: {
      &quot;@typescript-eslint/eslint-plugin&quot;: &quot;^5.16.0&quot;,
      &quot;@typescript-eslint/parser&quot;: &quot;^5.16.0&quot;,
      &quot;ansi-regex&quot;: &quot;^6.0.1&quot;,
      &quot;eslint&quot;: &quot;^8.12.0&quot;,
      &quot;eslint-config-prettier&quot;: &quot;^8.5.0&quot;,
      &quot;eslint-plugin-prettier&quot;: &quot;^4.0.0&quot;,
      &quot;glob-parent&quot;: &quot;^6.0.2&quot;,
      &quot;node-forge&quot;: &quot;^1.3.0&quot;,
      &quot;nth-check&quot;: &quot;^2.0.1&quot;,
      &quot;parcel&quot;: &quot;^2.4.0&quot;,
      &quot;parcel-bundler&quot;: &quot;^1.12.5&quot;,
      &quot;postcss&quot;: &quot;^8.4.12&quot;,
      &quot;prettier&quot;: &quot;^2.6.1&quot;,
      &quot;typescript&quot;: &quot;^4.6.3&quot;
    },
    &quot;dependencies&quot;: {
      &quot;npm&quot;: &quot;^8.5.5&quot;
    }
  }
  </code></pre>
  <p>This should give you 24 vulnerabilities, 18 moderate and 6 high (at the time of writing, running npm 8.5.5).</p>