- [Instructor] Now let's review all the details
we got from the report.
We see more details like if the issue is low or moderate,
so this is the severity of the issue,
the recommended action
is to fix at your own leisure when it's low.
But if it is high or critical,
you need to address it ASAP.
Then it gives you a little bit details
as to what is the issue, so, for example,
here we have a Regular Expression Denial of Service
with this particular package,
then we have the name of the package, which is here,
what version fixes this issue, path of the package,
and more information if you'd like to explore this further,
so if you want to explore what is the issue
with this particular package,
you can literally click on the link here
and get more information.
Let me just close the explorer
so we can see more information.
The next thing is, and we don't have an example here,
if you see a SemVer, so S-E-M-V-E-R warning,
that means the patch could be breaking the package.
So we don't have any of those in this particular report,
but you'd see it somewhere around the more information,
and if you see that warning, please pay attention
before you actually try to fix it.
So then, at that point, you can either do
an NPM audit fix, or simply install the packages
one-by-one, so reinstall the packages
that are part of this report.
So let's go and try a fix.
So let me go at the bottom of this particular window,
and let's try a fix.
So now, what NPM is going to try to do is fix it.
There's a strong possibility that it won't
be able to fix it.
If it's not able to fix it,
then you'll see a report like this.
That means that we scanned it,
and we are not able to fix it, so we require manual review.
So if you'd like to review it, keep the report open,
and then go to each of the packages that are an issue.
So let's go to the one that is High, so Critical,
something that needs to be paid attention to.
So the package is parsejson,
so there's no patch available right now,
so that could be an issue.
So let's go inside of that package,
parsejson should be roughly here,
and then let's take a look at the README files
to see if there's anything worth noting in here,
there's nothing.
So we obviously need to take a look at this further,
so we will need to investigate directly
with first the issues.
I would go to the site here,
trying to figure out what is the issue with this package,
and then go directly to the GitHub repo
of this package here, parsejson,
and go to NPM to figure out what is happening.
So we won't be able to fix this in this video
because we need to do more investigation,
but that would be the next step.
So just to make sure that you understand the steps
is first you do the NPM audit,
and then you check the report to find any High,
or Critical issues.
And again, this is a Regular Expression Denial of Service,
that means that could render your application useless.
And then the Package, and so on and so forth,
we have more information on this link,
so we would go to this link,
and then figure out where we can get more information
on this package.
I would also go to the GitHub repo for that package
if it is existing, and then raise an issue
in their GitHub repo to make sure that they're aware
that there are an issue right now.