如果存在修复则更新依赖包
如果存在修复程序,但依赖于具有漏洞的程序包的程序包尚未更新以包含固定版本,则您可能希望在依赖程序包存储库上打开拉取或合并请求以使用固定版本。
If a fix exists but packages that depend on the package with the vulnerability have not been updated to include the fixed version, you may want to open a pull or merge request on the dependent package repository to use the fixed version.
- 要查找必须更新的包,请检查 "Path" 字段以获取存在漏洞的包的位置,然后检查依赖于它的包。例如,如果漏洞的路径是
@package-name > dependent-package > package-with-vulnerability
,则需要更新dependent-package
。mrepn9fwdMLydU9XQ84i5HDJH2nU7i4BohHPa1wN9kPpCsMCF5JNiga8MzFoTwlMjMTvac7U8L2kw8E5Pc/HE4fNKgeVuqYPww/WWOjPJFOvYjHBZ23GOQWp9w4d/rJEteuMWPrdxq8zTKBgacoLbE37Ie1+0Fyrn3fw5cwxiRJCYn6uuIwl7ZcLGdLXG6JPC2HwZoYRMTk5eH21OVbxQuGIpkoS9M15aaFROzaIJ9HxJJENZGz+pu9N5HTOTbhQOF9q5yBuT4Cd/mliaQ/kpiROETwpQWNTmIKe9n/C78enH1rQkYWsc/97jJS7wW0kxu8lJtSv9+e9YRaUv8xst7YsTeQ0iK5LVQHjeI5oYhGF8FJG+2Wzmdnm4AFdltLgsB89H/rrMJWdNulmSRZpMJwqwYkSovp7v4SP/fwH7Tvy/6cPeGg6DhzQ8XpSEvs86XHokjjexOjRrzo6PXrqhrX98WgSeT9zhzQsndxFURM=
- 在 npm 公共注册表 上,找到依赖包并导航到其存储库。有关查找包的更多信息,请参阅 "搜索并选择要下载的包"。
xxTc3AY8Ui58TT1vlW6gIRpzuKxXXNaDefXc+8OpGkrdtF0KyV1hU8TNDANX6i6CZ/plKyqXUqGZJMCBEaxzj1pHubU3TsidfVlmxn1G9mL6QTJFu6o1U2pqG7S8oBSxXgwkHUypIpo5ZVzuZeUyeAOtkYiQIDnexZiOSaP5CUbDWNXuEqsKzxScZ1wXNB8Xh+1g2LwDMYCt56nF2kgd2Gj+fzezvMURqp+ioyIVfw8a8pvypuyAGGc/rJZN9Ya39y4D1o3WkwROce969MJWTc5wfnmQfCdb5pFE/Dj1RqcdWkbo1CJTvAiNzfG9I8Yx/6Q5d1pShAmPQ1XjkTi86Ohwd4vQBxNnUpwj03vQ3Z1NqB7pkhP3yw533whGypQf
- 在依赖包存储库中,打开拉取或合并请求以将易受攻击的包的版本更新为具有修复的版本。
M8MtHxCtN8f/+WvDxfrPsu3q2/c24pzeFussp6aTC1eBdue2RenC6v9tDXtJJk3JbgObfv8sJFKQaGy8qMdaMmQjNoW6HLE39PqgJvNIvxpFpccaZy2uRULvsSTh1VsaTAWuMXVH3Wzlp5IysdvWH0HkCLVEn71CtOOM/mDvtrDSZs+wimn/0cY8CqYE+s11
- 合并拉取或合并请求并且包已在 npm 公共注册表 中更新后,请使用
npm update
更新您的包副本。BTCw6+wjZ8AhGAbFrDeIdonYI3w5p6i2riSPCgMamPmy3TqeWRbyEJB3dDlO6T1ViDXrQvjVATnjGdbBKmkL7HZRK1xKfpUMhHBCAH82x3OHfV1+gmru3fAY2Iobu+AgMBNd5ApwBkdfaIT5q95aH81cvsYpdt9M3C77YIIcU4gC6e1uY+z0ZCYTiy/4tAf/9858IsmKZf/rVgKl8gJ12bvgHKptU5Jcoz8ZWYLGfKbLZ/JSwM3hYajPnDXtnxKdc701JqY9+dDw6jrFQH9K5yqoY8r8SjvTfUBq7iypCFY=