I didn't make the topic on here, it was somewhere else. But I'll just copy and paste it.
Hi! Something weird is going on when I try to run:
npm install --save @openzeppelin/contracts@v3.0.0
It always tells me about some dependencies that could use a fix. So, I run npm audit fix
but it always just tells me about more errors. Running npm audit fix
a second time does nothing.
So I decided to try npm audit fix --force
to see if it would clear up all the issues. That command still outputs some dependency warnings. And if I run npm install --save @openzeppelin/contracts@v3.0.0
again or just plain npm install --save @openzeppelin/contracts
to get the latest version, it still just outputs more warnings and I can't fix them with npm
.
Here is what my terminal looks like (shortened version so it doesn't take up a bunch of space):
jest-environment-node 18.5.0-alpha.7da3df39 - 22.4.3 || 23.4.0
Depends on vulnerable versions of jest-util
node_modules/jest-environment-node
jest-snapshot 18.5.0-alpha.7da3df39 - 21.0.0-beta.1
{...}
67 vulnerabilities (25 low, 9 moderate, 33 high)
* To address issues that do not require attention, run:
npm audit fix
* To address all issues possible (including breaking changes), run:
npm audit fix --force
* Some issues need review, and may require choosing a different dependency.
PS C:\Users\...\Desktop\Solidity\tokenproject> npm install @openzeppelin/contracts
* up to date, audited 2007 packages in 51s
* 75 packages are looking for funding
run `npm fund` for details
* 67 vulnerabilities (25 low, 9 moderate, 33 high)
To address issues that do not require attention, run:
npm audit fix
* To address all issues possible (including breaking changes), run:
npm audit fix --force
* Some issues need review, and may require choosing
a different dependency.
* Run `npm audit` for details.
PS C:\Users\...\Desktop\Solidity\tokenproject> npm audit fix
* up to date, audited 2007 packages in 2m
* 75 packages are looking for funding
run `npm fund` for details
* # npm audit report
* braces <2.3.1
Regular Expression Denial of Service - https://npmjs.com/advisories/786
fix available via `npm audit fix --force`
Will install react-scripts@4.0.3, which is a breaking change
node_modules/braces
micromatch 0.2.0 - 2.3.11
Depends on vulnerable versions of braces
Depends on vulnerable versions of parse-glob
{...}
* 67 vulnerabilities (25 low, 9 moderate, 33 high)
* To address issues that do not require attention, run:
npm audit fix
* To address all issues possible (including breaking changes), run:
npm audit fix --force
* Some issues need review, and may require choosing
a different dependency.
I think my terminal cut off some of the commands I ran, but you get the gist. As I said before, running npm audit fix --force
outputs the same kind of results as you see above, with the other commands. I'm not sure if I tried npm install --save openzeppelin/contracts@v3.0.0-beta.0
, but in one of my instructors' sites (I was doing this for a blockchain course), it says,
"Update from the Video
Note we will be using the v3.0.0 of openzeppelin contracts, instead of v3.0.0-beta.0"
So I wasn't exactly keen to type the command.
How do I go about fixing this? I was tempted to uninstall npm completely and reinstall it, but I'm not sure that would help this situation. Especially if simply typing npm install --save openzeppelin/contracts@v3.0.0
doesn't work. I don't think npm itself is the problem.
Oh and, btw, I know that npm usually tells you about stuff can be fixed when you run any kind of npm install
command, but it will also say + blah-blah-blah@1.2.3 ...
, showing that the package was installed. That's not happening. What IS happening is that sometimes the @openzeppelin
folder will go under the node_modules
folder that's designated for my entire computer. Instead I need a node_modules
folder under my directory for this token project, but nothing ever comes up. I tried moving the @openzeppelin
folder to my directory, but I'm not sure if that's the right thing to do. I might go back to that, though.
Any help would be appreciated!