填坑时间

-启动项目时出出错- 报错信息

found 14 vulnerabilities (5 low, 3 moderate, 6 high) run `npm audit fix` to fix them, or `npm audit` for ...//信息显示有14个漏洞

npm audit fix //自行修复，还有一些漏洞还是不能修复
npm audit fix --force //强制修复，会自动安装需要的npm包
顽固不灵的还有一个要手动修复，显示``

fixed 11 of 12 vulnerabilities in 5918 scanned packages
  1 vulnerability required manual review and could not 
  5 package updates for 11 vulnerabilities involved bre
  (installed due to `--force` option)

npm audit，看看是什么玩意要手动修复，clean-css这个包

=== npm audit security report ==


                                 Manual Review
             Some vulnerabilities require your attentio
 
          Visit https://go.npm.me/audit-guide for addit


  Low             Regular Expression Denial of Service

  Package         clean-css


  More info       https://npmjs.com/advisories/785

found 1 low severity vulnerability in 8340 scanned packages
  1 vulnerability requires manual review. See the full report for detai...

npm install --save-dev clean-css，命令行手动安装

+ clean-css@4.2.3
updated 1 package and audited 8342 packages in 9.94s

9 packages are looking for funding
  run `npm fund` for details

found 1 low severity vulnerability
  run `npm audit fix` to fix them, or `npm audit` for details

这里我就很疑问，已经安装了还是不行

npm audit -json，

//clean-css的版本太低了，可是我已经update了
"module_name": "clean-css",
      "cves": [],
      "vulnerable_versions": "<4.1.11",
      "patched_versions": ">=4.1.11",
      "overview": "Version of `clean-css` prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may 
cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.",
      "recommendation": "Upgrade to version 4.1.11 or higher.",        
      "references": "- [GitHub Commit](https://github.com/jakubpawlowicz/clean-css/commit/2929bafbf8cdf7dccb24e0949c70833764fa87e3)",...

最后一步是在根目录下的package-lock.json，将clean-css的版本号改成最新的，我的是4.2.3，对应的全部都要改
npm audit，大功告成！！！

                       === npm audit security report ===
         
found 0 vulnerabilities
 in 8342 scanned packages