The company I work for needs custom web parts in modern SharePoint.

I was humming along following the excellent (Microsoft's sponsored) tutorials on SPFx development. I got my web part working on my DEV tenant and all that.

Now that I am getting things ready for production I am shocked to find the out-of-the-box vulnerabilities introduced by yo @microsoft/sharepoint are not that easy to fix. I need to go through each package one by one.

Am I missing something? I am seeking latest guidance on how to address the vulnerabilities. I am new to this tool set.

Many Thanks in advance.

  • Please share what vulnerabilities you are concerned about, or a link to where you found these vulnerabilities documented. Your statement is a little too vague for anyone to address.
    – willman
    Mar 2 '20 at 0:48
  • Thank you @willman The following modules are reported from "npm audit": "module_name": "minimatch", "url": "npmjs.com/advisories/118" "module_name": "fresh", "url": "npmjs.com/advisories/526" "module_name": "lodash", "url": "npmjs.com/advisories/782" "module_name": "qs", "url": "npmjs.com/advisories/1469" MODERATE: "module_name": "mime", "url": "npmjs.com/advisories/535" "module_name": "serialize-javascript", "url": "npmjs.com/advisories/1426"
    – Miryam
    Mar 2 '20 at 1:24
  • Which versions of yeoman and SPFx are you using?
    – willman
    Mar 2 '20 at 1:46
  • The advisories recommend fixing the versions. Problem is that above mentioned packages are dependencies of many others. If in the json manifest I see dependencies that that have too old version of the problem package. Example: Recommendation to upgrade 'minimatch' to version '3.0.2' or greater . Some versions used are '2.0.1' . This will cause a break in functionality if I change to '3.0.2'. Therefore it means I will have to fix the affected package code manually.
    – Miryam
    Mar 2 '20 at 1:47
  • @willman, I got these versions: +-- @microsoft/generator-sharepoint@1.10.0 `-- yo@3.1.1
    – Miryam
    Mar 2 '20 at 1:52

With SPFx solutions, none of the npm packages are deployed to SharePoint, so you can ignore these audit warnings. If you had a custom solution that did deploy the npm packages themselves, yes you'd need to address it.

Don't be alarmed by vulnerabilities after running NPM Install

  • Thanks @trevorseward for sharing the article. All I am doing is pulling one of the wonderful web parts from sharepoint.github.io/sp-dev-fx-webparts/samples/all This web part will go to production very much as is. I did run the 'npm install' on the folder which brought the audit report same as in 'yeoman @microsoft/sharepoint'
    – Miryam
    Mar 2 '20 at 2:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.