Multiple high severity vulnerabilities warnings while installing Remix Blues stack about blues-stack

[kentcdodds]

The issue is not with the blues stack but with transitive dependencies. We can't do anything about those in this repo, so I'll close this issue. Feel free to open PRs in the deps to fix these issues.

[machour]

Thinking out loud: should we enable dependabot for stacks?

[binajmen]

@MichaelDeBoey no problem on my side. As I suppose these kind of warnings will trigger future remix'ers, it is still good to acknowledge it here.

It seems to be a false positive anyway: sindresorhus/trim-newlines#8 (comment)

No, it's not serious. It's just a "vulnerability" that may affect 0.0000001% of users, but waste the time of everyone.

I leave it to you to decide whether or not you want to keep the issue open ;)

[MichaelDeBoey]

@binajmen I've created a PR to remove the unused chalk-animation dependency, which is causing this warning: remix-run/remix#2547

[MichaelDeBoey]

@machour I know @kentcdodds isn't a fan of using @dependabot, although I think it can be valuable tbh.

[MichaelDeBoey]

@binajmen I just updated all dependencies in #25 (did this for all stacks), but I still get these 4 severity vulnerabilities warnings, so nothing else we can do for now I'm afraid 🤷‍♂️

[MichaelDeBoey]

@binajmen Strange, as I still get them when removing node_modules & package-lock.json and running npm i 🤔

[binajmen]

By false positive, I meant "classified as not a serious vulnerability" by the author.

This is supposed to be a 4 lines package 😄
sindresorhus/trim-newlines@25246c6

[isaacs]

In the meantime: remix-run/remix#2373 (comment)

[MichaelDeBoey]

remix-run/remix#2547 is merged, so it will be released when 3.4.0 gets released.
Once that's done, we'll update the package-lock.json of all stacks, which should fix these warnings