After npm aduit fix, trivy still have the same vulnerabilities in html report

[kamil1027]

Using minimist 1.2.5

After npm aduit fix Using minimist 1.2.6

In the report, it displays the 1.2.5 version of minimist. In my opinion, if i use npm aduit fix, there should not display the minimist because it had already fixed by npm aduit fix

[DmitriyLewen]

Hello @kamil1027 Thank for your report!

If i understand correctly nmp audit fix doesn't fix dependencies in yarn.lock files(https://stackoverflow.com/questions/51732435/is-there-a-yarn-alternative-for-npm-audit).

Your report contains vulnerabilities from yarn.lock file. Path to file you be found using -format json flag(Target field). For example:

➜ trivy fs -f json . 
2022-06-27T12:23:00.547+0600	INFO	Vulnerability scanning is enabled
2022-06-27T12:23:00.547+0600	INFO	Secret scanning is enabled
2022-06-27T12:23:00.547+0600	INFO	If your scanning is slow, please try '--security-checks vuln' to disable secret scanning
2022-06-27T12:23:00.547+0600	INFO	Please see also https://aquasecurity.github.io/trivy/v0.29.1/docs/secret/scanning/#recommendation for faster secret detection
2022-06-27T12:23:00.548+0600	INFO	Number of language-specific files: 1
2022-06-27T12:23:00.548+0600	INFO	Detecting yarn vulnerabilities...
{
  ...

  "Results": [
    {
      "Target": "test/yarn.lock",
      "Class": "lang-pkgs",
      "Type": "yarn",

  ...

Can you check your yarn.lock file?

Regards, Dmitriy

[kamil1027]

In yarn.lock file, some of dependencies have been upgraded to the safe version. Dependency example: minimist

However, some dependencies have not upgrade. Jusk like

I think that this question should be caused by the dependency version. If i need to use the package with a outdate and risk version, there is no any actions that i can do. The only action should be waiting for the package owner updating the package dependencies to a safe version.

That is my consideration about the question. Sorry for late.

[DmitriyLewen]

I think you can try to convert package-lock.json file into yarn.lock: https://stackoverflow.com/a/60878037. This may solve your problem.

[github-actions[bot]]

This issue is stale because it has been labeled with inactivity.