title: npm audit fix --force never able to avoid vulnerabilities
body: <p>I'm stuck in a situation where I've either got 22 vulnerabilities or 47. I can run <code>npm audit fix</code> but I'm always suggested to run the <code>--force</code> switch in order to actually perform an upgrade. From there I can either upgrade and get 22 vulns and then I perform the <code>--force</code> again and get 47 vulns, this cycle continues forever. What's the best way out, just leave the packages the way they are?</p>
  <p>my package.json</p>
  <pre><code>  &quot;dependencies&quot;: {
      &quot;animate.css&quot;: &quot;^4.1.1&quot;,
      &quot;axios&quot;: &quot;^0.21.1&quot;,
      &quot;bootstrap&quot;: &quot;^4.5.3&quot;,
      &quot;http-proxy-middleware&quot;: &quot;^0.19.1&quot;,
      &quot;react&quot;: &quot;^17.0.1&quot;,
      &quot;react-dom&quot;: &quot;^17.0.1&quot;,
      &quot;react-ga&quot;: &quot;^3.3.0&quot;,
      &quot;react-router-dom&quot;: &quot;^5.2.0&quot;,
      &quot;react-scripts&quot;: &quot;^1.1.5&quot;,
      &quot;universal-cookie&quot;: &quot;^4.0.4&quot;,
      &quot;web-vitals&quot;: &quot;^0.2.4&quot;
    },
  </code></pre>
  <p>When I try <code>npm --audit fix</code> in one situation:</p>
  <pre><code>npm ERR! code ERESOLVE
  npm ERR! ERESOLVE unable to resolve dependency tree
  npm ERR!
  npm ERR! Found: type-fest@0.21.3
  npm ERR! node_modules/type-fest
  npm ERR!   type-fest@&quot;^0.21.3&quot; from ansi-escapes@4.3.2
  npm ERR!   node_modules/ansi-escapes
  npm ERR!     ansi-escapes@&quot;^4.2.1&quot; from @jest/core@26.6.3
  npm ERR!     node_modules/@jest/core
  npm ERR!       @jest/core@&quot;^26.6.0&quot; from jest@26.6.0
  npm ERR!       node_modules/jest
  npm ERR!         peer jest@&quot;^26.0.0&quot; from jest-watch-typeahead@0.6.1
  npm ERR!         node_modules/jest-watch-typeahead
  npm ERR!         1 more (react-scripts)
  npm ERR!       1 more (jest-cli)
  npm ERR!     ansi-escapes@&quot;^4.3.1&quot; from jest-watch-typeahead@0.6.1
  npm ERR!     node_modules/jest-watch-typeahead
  npm ERR!       jest-watch-typeahead@&quot;0.6.1&quot; from react-scripts@4.0.3
  npm ERR!       node_modules/react-scripts
  npm ERR!         react-scripts@&quot;^4.0.3&quot; from the root project
  npm ERR!     2 more (jest-watcher, terminal-link)
  npm ERR!
  npm ERR! Could not resolve dependency:
  npm ERR! peerOptional type-fest@&quot;^0.13.1&quot; from @pmmmwh/react-refresh-webpack-plugin@0.4.3
  npm ERR! node_modules/@pmmmwh/react-refresh-webpack-plugin
  npm ERR!   @pmmmwh/react-refresh-webpack-plugin@&quot;0.4.3&quot; from react-scripts@4.0.3
  npm ERR!   node_modules/react-scripts
  npm ERR!     react-scripts@&quot;^4.0.3&quot; from the root project
  npm ERR!
  npm ERR! Fix the upstream dependency conflict, or retry
  npm ERR! this command with --force, or --legacy-peer-deps
  npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
  </code></pre>
  <p>And then when I run it after another <code>--force</code></p>
  <pre><code># npm audit report
  
  braces  &lt;2.3.1
  Regular Expression Denial of Service - https://npmjs.com/advisories/786
  fix available via `npm audit fix --force`
  Will install react-scripts@4.0.3, which is a breaking change
  node_modules/anymatch/node_modules/braces
  node_modules/jest-cli/node_modules/braces
  node_modules/jest-haste-map/node_modules/braces
  node_modules/jest-message-util/node_modules/braces
  node_modules/jest-runtime/node_modules/braces
  node_modules/test-exclude/node_modules/braces
  node_modules/webpack-dev-server/node_modules/http-proxy-middleware/node_modules/braces
    micromatch  0.2.0 - 2.3.11
    Depends on vulnerable versions of braces
    Depends on vulnerable versions of parse-glob
    node_modules/anymatch/node_modules/micromatch
    node_modules/jest-cli/node_modules/micromatch
    node_modules/jest-haste-map/node_modules/micromatch
    node_modules/jest-message-util/node_modules/micromatch
    node_modules/jest-runtime/node_modules/micromatch
    node_modules/test-exclude/node_modules/micromatch
    node_modules/webpack-dev-server/node_modules/http-proxy-middleware/node_modules/micromatch
      anymatch  1.2.0 - 1.3.2
      Depends on vulnerable versions of micromatch
      node_modules/anymatch
        sane  1.0.4 - 4.0.1
        Depends on vulnerable versions of anymatch
        Depends on vulnerable versions of exec-sh
        node_modules/sane
          jest-haste-map  16.1.0-alpha.691b0e22 - 24.0.0
          Depends on vulnerable versions of micromatch
          Depends on vulnerable versions of sane
          node_modules/jest-haste-map
            jest-cli  12.1.1-alpha.2935e14d || 12.1.2-alpha.6230044c - 24.8.0
            Depends on vulnerable versions of jest-haste-map
            Depends on vulnerable versions of jest-jasmine2
            Depends on vulnerable versions of jest-message-util
            Depends on vulnerable versions of jest-snapshot
            Depends on vulnerable versions of micromatch
            Depends on vulnerable versions of yargs
            node_modules/jest-cli
              jest  18.5.0-alpha.7da3df39 - 22.4.4 || 23.4.0 - 23.6.0
              Depends on vulnerable versions of jest-cli
              node_modules/jest
                react-scripts  0.1.0 - 2.1.8
                Depends on vulnerable versions of babel-jest
                Depends on vulnerable versions of css-loader
                Depends on vulnerable versions of file-loader
                Depends on vulnerable versions of jest
                Depends on vulnerable versions of sw-precache-webpack-plugin
                Depends on vulnerable versions of webpack
                Depends on vulnerable versions of webpack-dev-server
                node_modules/react-scripts
            jest-runtime  12.1.1-alpha.2935e14d - 24.8.0
            Depends on vulnerable versions of babel-jest
            Depends on vulnerable versions of babel-plugin-istanbul
            Depends on vulnerable versions of jest-haste-map
            Depends on vulnerable versions of jest-util
            Depends on vulnerable versions of micromatch
            Depends on vulnerable versions of yargs
            node_modules/jest-runtime
      http-proxy-middleware  0.3.0 - 0.17.4
      Depends on vulnerable versions of micromatch
      node_modules/webpack-dev-server/node_modules/http-proxy-middleware
        webpack-dev-server  &lt;=3.11.2
        Depends on vulnerable versions of chokidar
        Depends on vulnerable versions of http-proxy-middleware
        Depends on vulnerable versions of webpack
        Depends on vulnerable versions of yargs
        node_modules/webpack-dev-server
      jest-message-util  18.5.0-alpha.7da3df39 - 23.1.0 || 23.4.0 - 24.0.0-alpha.16
      Depends on vulnerable versions of micromatch
      node_modules/jest-message-util
        jest-jasmine2  18.5.0-alpha.7da3df39 - 22.4.4 || 23.4.0 - 23.6.0
        Depends on vulnerable versions of jest-matchers
        Depends on vulnerable versions of jest-message-util
        node_modules/jest-jasmine2
          jest-config  18.5.0-alpha.7da3df39 - 22.4.4 || 23.4.0 - 23.6.0
          Depends on vulnerable versions of jest-jasmine2
          node_modules/jest-config
        jest-matchers  &gt;=18.5.0-alpha.7da3df39
        Depends on vulnerable versions of jest-message-util
        node_modules/jest-matchers
        jest-util  18.5.0-alpha.7da3df39 - 22.4.3 || 23.4.0
        Depends on vulnerable versions of jest-message-util
        node_modules/jest-util
          jest-environment-jsdom  18.5.0-alpha.7da3df39 - 22.4.3 || 23.4.0
          Depends on vulnerable versions of jest-util
          node_modules/jest-environment-jsdom
          jest-environment-node  18.5.0-alpha.7da3df39 - 22.4.3 || 23.4.0
          Depends on vulnerable versions of jest-util
          node_modules/jest-environment-node
          jest-snapshot  18.5.0-alpha.7da3df39 - 21.0.0-beta.1
          Depends on vulnerable versions of jest-util
          node_modules/jest-snapshot
      test-exclude  &lt;=4.2.3
      Depends on vulnerable versions of micromatch
      node_modules/test-exclude
        babel-plugin-istanbul  &lt;=5.0.0
        Depends on vulnerable versions of test-exclude
        node_modules/babel-plugin-istanbul
          babel-jest  14.2.0-alpha.ca8bfb6e - 24.0.0-alpha.16
          Depends on vulnerable versions of babel-plugin-istanbul
          node_modules/babel-jest
  
  glob-parent  &lt;5.1.2
  Severity: moderate
  Regular expression denial of service - https://npmjs.com/advisories/1751
  fix available via `npm audit fix --force`
  Will install react-scripts@4.0.3, which is a breaking change
  node_modules/glob-base/node_modules/glob-parent
  node_modules/webpack-dev-server/node_modules/glob-parent
    chokidar  1.0.0-rc1 - 2.1.8
    Depends on vulnerable versions of glob-parent
    node_modules/webpack-dev-server/node_modules/chokidar
      webpack-dev-server  &lt;=3.11.2
      Depends on vulnerable versions of chokidar
      Depends on vulnerable versions of http-proxy-middleware
      Depends on vulnerable versions of webpack
      Depends on vulnerable versions of yargs
      node_modules/webpack-dev-server
        react-scripts  0.1.0 - 2.1.8
        Depends on vulnerable versions of babel-jest
        Depends on vulnerable versions of css-loader
        Depends on vulnerable versions of file-loader
        Depends on vulnerable versions of jest
        Depends on vulnerable versions of sw-precache-webpack-plugin
        Depends on vulnerable versions of webpack
        Depends on vulnerable versions of webpack-dev-server
        node_modules/react-scripts
    glob-base  *
    Depends on vulnerable versions of glob-parent
    node_modules/glob-base
      parse-glob  &gt;=2.1.0
      Depends on vulnerable versions of glob-base
      node_modules/parse-glob
        micromatch  0.2.0 - 2.3.11
        Depends on vulnerable versions of braces
        Depends on vulnerable versions of parse-glob
        node_modules/anymatch/node_modules/micromatch
        node_modules/jest-cli/node_modules/micromatch
        node_modules/jest-haste-map/node_modules/micromatch
        node_modules/jest-message-util/node_modules/micromatch
        node_modules/jest-runtime/node_modules/micromatch
        node_modules/test-exclude/node_modules/micromatch
        node_modules/webpack-dev-server/node_modules/http-proxy-middleware/node_modules/micromatch
          anymatch  1.2.0 - 1.3.2
          Depends on vulnerable versions of micromatch
          node_modules/anymatch
            sane  1.0.4 - 4.0.1
            Depends on vulnerable versions of anymatch
            Depends on vulnerable versions of exec-sh
            node_modules/sane
              jest-haste-map  16.1.0-alpha.691b0e22 - 24.0.0
              Depends on vulnerable versions of micromatch
              Depends on vulnerable versions of sane
              node_modules/jest-haste-map
                jest-cli  12.1.1-alpha.2935e14d || 12.1.2-alpha.6230044c - 24.8.0
                Depends on vulnerable versions of jest-haste-map
                Depends on vulnerable versions of jest-jasmine2
                Depends on vulnerable versions of jest-message-util
                Depends on vulnerable versions of jest-snapshot
                Depends on vulnerable versions of micromatch
                Depends on vulnerable versions of yargs
                node_modules/jest-cli
                  jest  18.5.0-alpha.7da3df39 - 22.4.4 || 23.4.0 - 23.6.0
                  Depends on vulnerable versions of jest-cli
                  node_modules/jest
                jest-runtime  12.1.1-alpha.2935e14d - 24.8.0
                Depends on vulnerable versions of babel-jest
                Depends on vulnerable versions of babel-plugin-istanbul
                Depends on vulnerable versions of jest-haste-map
                Depends on vulnerable versions of jest-util
                Depends on vulnerable versions of micromatch
                Depends on vulnerable versions of yargs
                node_modules/jest-runtime
          http-proxy-middleware  0.3.0 - 0.17.4
          Depends on vulnerable versions of micromatch
          node_modules/webpack-dev-server/node_modules/http-proxy-middleware
          jest-message-util  18.5.0-alpha.7da3df39 - 23.1.0 || 23.4.0 - 24.0.0-alpha.16
          Depends on vulnerable versions of micromatch
          node_modules/jest-message-util
            jest-jasmine2  18.5.0-alpha.7da3df39 - 22.4.4 || 23.4.0 - 23.6.0
            Depends on vulnerable versions of jest-matchers
            Depends on vulnerable versions of jest-message-util
            node_modules/jest-jasmine2
              jest-config  18.5.0-alpha.7da3df39 - 22.4.4 || 23.4.0 - 23.6.0
              Depends on vulnerable versions of jest-jasmine2
              node_modules/jest-config
            jest-matchers  &gt;=18.5.0-alpha.7da3df39
            Depends on vulnerable versions of jest-message-util
            node_modules/jest-matchers
            jest-util  18.5.0-alpha.7da3df39 - 22.4.3 || 23.4.0
            Depends on vulnerable versions of jest-message-util
            node_modules/jest-util
              jest-environment-jsdom  18.5.0-alpha.7da3df39 - 22.4.3 || 23.4.0
              Depends on vulnerable versions of jest-util
              node_modules/jest-environment-jsdom
              jest-environment-node  18.5.0-alpha.7da3df39 - 22.4.3 || 23.4.0
              Depends on vulnerable versions of jest-util
              node_modules/jest-environment-node
              jest-snapshot  18.5.0-alpha.7da3df39 - 21.0.0-beta.1
              Depends on vulnerable versions of jest-util
              node_modules/jest-snapshot
          test-exclude  &lt;=4.2.3
          Depends on vulnerable versions of micromatch
          node_modules/test-exclude
            babel-plugin-istanbul  &lt;=5.0.0
            Depends on vulnerable versions of test-exclude
            node_modules/babel-plugin-istanbul
              babel-jest  14.2.0-alpha.ca8bfb6e - 24.0.0-alpha.16
              Depends on vulnerable versions of babel-plugin-istanbul
              node_modules/babel-jest
  
  js-yaml  &lt;=3.13.0
  Severity: high
  Denial of Service - https://npmjs.com/advisories/788
  Code Injection - https://npmjs.com/advisories/813
  fix available via `npm audit fix --force`
  Will install react-scripts@4.0.3, which is a breaking change
  node_modules/svgo/node_modules/js-yaml
    svgo  0.4.2 - 1.0.5
    Depends on vulnerable versions of js-yaml
    node_modules/svgo
      postcss-svgo  &lt;=2.1.6
      Depends on vulnerable versions of svgo
      node_modules/postcss-svgo
        cssnano  &lt;=3.10.0
        Depends on vulnerable versions of postcss-normalize-url
        Depends on vulnerable versions of postcss-svgo
        node_modules/cssnano
          css-loader  0.15.0 - 0.28.11
          Depends on vulnerable versions of cssnano
          node_modules/css-loader
            react-scripts  0.1.0 - 2.1.8
            Depends on vulnerable versions of babel-jest
            Depends on vulnerable versions of css-loader
            Depends on vulnerable versions of file-loader
            Depends on vulnerable versions of jest
            Depends on vulnerable versions of sw-precache-webpack-plugin
            Depends on vulnerable versions of webpack
            Depends on vulnerable versions of webpack-dev-server
            node_modules/react-scripts
  
  mem  &lt;4.0.0
  Denial of Service - https://npmjs.com/advisories/1084
  fix available via `npm audit fix --force`
  Will install react-scripts@4.0.3, which is a breaking change
  node_modules/mem
    os-locale  2.0.0 - 3.0.0
    Depends on vulnerable versions of mem
    node_modules/webpack/node_modules/os-locale
      yargs  4.0.0-alpha1 - 12.0.5 || 14.1.0 || 15.0.0 - 15.2.0
      Depends on vulnerable versions of os-locale
      Depends on vulnerable versions of yargs-parser
      node_modules/webpack-dev-server/node_modules/yargs
      node_modules/webpack/node_modules/yargs
      node_modules/yargs
        jest-cli  12.1.1-alpha.2935e14d || 12.1.2-alpha.6230044c - 24.8.0
        Depends on vulnerable versions of jest-haste-map
        Depends on vulnerable versions of jest-jasmine2
        Depends on vulnerable versions of jest-message-util
        Depends on vulnerable versions of jest-snapshot
        Depends on vulnerable versions of micromatch
        Depends on vulnerable versions of yargs
        node_modules/jest-cli
          jest  18.5.0-alpha.7da3df39 - 22.4.4 || 23.4.0 - 23.6.0
          Depends on vulnerable versions of jest-cli
          node_modules/jest
            react-scripts  0.1.0 - 2.1.8
            Depends on vulnerable versions of babel-jest
            Depends on vulnerable versions of css-loader
            Depends on vulnerable versions of file-loader
            Depends on vulnerable versions of jest
            Depends on vulnerable versions of sw-precache-webpack-plugin
            Depends on vulnerable versions of webpack
            Depends on vulnerable versions of webpack-dev-server
            node_modules/react-scripts
        jest-runtime  12.1.1-alpha.2935e14d - 24.8.0
        Depends on vulnerable versions of babel-jest
        Depends on vulnerable versions of babel-plugin-istanbul
        Depends on vulnerable versions of jest-haste-map
        Depends on vulnerable versions of jest-util
        Depends on vulnerable versions of micromatch
        Depends on vulnerable versions of yargs
        node_modules/jest-runtime
        webpack  2.0.0-beta - 4.0.0-beta.3
        Depends on vulnerable versions of yargs
        node_modules/webpack
          babel-loader  7.0.0-alpha.1 - 7.1.2 || 8.0.0-beta.0 - 8.0.0-beta.6
          Depends on vulnerable versions of webpack
          node_modules/babel-loader
          extract-text-webpack-plugin  2.0.0-beta.0 - 3.0.2
          Depends on vulnerable versions of webpack
          node_modules/extract-text-webpack-plugin
          file-loader  1.1.1 - 1.1.9
          Depends on vulnerable versions of webpack
          node_modules/file-loader
          webpack-dev-server  &lt;=3.11.2
          Depends on vulnerable versions of chokidar
          Depends on vulnerable versions of http-proxy-middleware
          Depends on vulnerable versions of webpack
          Depends on vulnerable versions of yargs
          node_modules/webpack-dev-server
  
  merge  &lt;2.1.1
  Severity: high
  Prototype Pollution - https://npmjs.com/advisories/1666
  fix available via `npm audit fix --force`
  Will install react-scripts@4.0.3, which is a breaking change
  node_modules/merge
    exec-sh  &lt;=0.3.1
    Depends on vulnerable versions of merge
    node_modules/exec-sh
      sane  1.0.4 - 4.0.1
      Depends on vulnerable versions of anymatch
      Depends on vulnerable versions of exec-sh
      node_modules/sane
        jest-haste-map  16.1.0-alpha.691b0e22 - 24.0.0
        Depends on vulnerable versions of micromatch
        Depends on vulnerable versions of sane
        node_modules/jest-haste-map
          jest-cli  12.1.1-alpha.2935e14d || 12.1.2-alpha.6230044c - 24.8.0
          Depends on vulnerable versions of jest-haste-map
          Depends on vulnerable versions of jest-jasmine2
          Depends on vulnerable versions of jest-message-util
          Depends on vulnerable versions of jest-snapshot
          Depends on vulnerable versions of micromatch
          Depends on vulnerable versions of yargs
          node_modules/jest-cli
            jest  18.5.0-alpha.7da3df39 - 22.4.4 || 23.4.0 - 23.6.0
            Depends on vulnerable versions of jest-cli
            node_modules/jest
              react-scripts  0.1.0 - 2.1.8
              Depends on vulnerable versions of babel-jest
              Depends on vulnerable versions of css-loader
              Depends on vulnerable versions of file-loader
              Depends on vulnerable versions of jest
              Depends on vulnerable versions of sw-precache-webpack-plugin
              Depends on vulnerable versions of webpack
              Depends on vulnerable versions of webpack-dev-server
              node_modules/react-scripts
          jest-runtime  12.1.1-alpha.2935e14d - 24.8.0
          Depends on vulnerable versions of babel-jest
          Depends on vulnerable versions of babel-plugin-istanbul
          Depends on vulnerable versions of jest-haste-map
          Depends on vulnerable versions of jest-util
          Depends on vulnerable versions of micromatch
          Depends on vulnerable versions of yargs
          node_modules/jest-runtime
  
  normalize-url  &lt;=4.5.0 || 5.0.0 - 5.3.0 || 6.0.0
  Severity: high
  Regular Expression Denial of Service - https://npmjs.com/advisories/1755
  fix available via `npm audit fix --force`
  Will install react-scripts@4.0.3, which is a breaking change
  node_modules/normalize-url
    postcss-normalize-url  &lt;=4.0.1
    Depends on vulnerable versions of normalize-url
    node_modules/postcss-normalize-url
      cssnano  &lt;=3.10.0
      Depends on vulnerable versions of postcss-normalize-url
      Depends on vulnerable versions of postcss-svgo
      node_modules/cssnano
        css-loader  0.15.0 - 0.28.11
        Depends on vulnerable versions of cssnano
        node_modules/css-loader
          react-scripts  0.1.0 - 2.1.8
          Depends on vulnerable versions of babel-jest
          Depends on vulnerable versions of css-loader
          Depends on vulnerable versions of file-loader
          Depends on vulnerable versions of jest
          Depends on vulnerable versions of sw-precache-webpack-plugin
          Depends on vulnerable versions of webpack
          Depends on vulnerable versions of webpack-dev-server
          node_modules/react-scripts
  
  trim-newlines  &lt;3.0.1 || =4.0.0
  Severity: high
  Regular Expression Denial of Service - https://npmjs.com/advisories/1753
  fix available via `npm audit fix --force`
  Will install react-scripts@4.0.3, which is a breaking change
  node_modules/trim-newlines
    meow  3.4.0 - 5.0.0
    Depends on vulnerable versions of trim-newlines
    node_modules/meow
      sw-precache  &gt;=4.2.0
      Depends on vulnerable versions of meow
      node_modules/sw-precache
        sw-precache-webpack-plugin  &gt;=0.8.0
        Depends on vulnerable versions of sw-precache
        node_modules/sw-precache-webpack-plugin
          react-scripts  0.1.0 - 2.1.8
          Depends on vulnerable versions of babel-jest
          Depends on vulnerable versions of css-loader
          Depends on vulnerable versions of file-loader
          Depends on vulnerable versions of jest
          Depends on vulnerable versions of sw-precache-webpack-plugin
          Depends on vulnerable versions of webpack
          Depends on vulnerable versions of webpack-dev-server
          node_modules/react-scripts
  
  webpack-dev-server  &lt;=3.11.2
  Severity: high
  Missing Origin Validation - https://npmjs.com/advisories/725
  Depends on vulnerable versions of chokidar
  Depends on vulnerable versions of http-proxy-middleware
  Depends on vulnerable versions of webpack
  Depends on vulnerable versions of yargs
  fix available via `npm audit fix --force`
  Will install react-scripts@4.0.3, which is a breaking change
  node_modules/webpack-dev-server
    react-scripts  0.1.0 - 2.1.8
    Depends on vulnerable versions of babel-jest
    Depends on vulnerable versions of css-loader
    Depends on vulnerable versions of file-loader
    Depends on vulnerable versions of jest
    Depends on vulnerable versions of sw-precache-webpack-plugin
    Depends on vulnerable versions of webpack
    Depends on vulnerable versions of webpack-dev-server
    node_modules/react-scripts
  
  yargs-parser  &lt;=13.1.1 || 14.0.0 - 15.0.0 || 16.0.0 - 18.1.1
  Prototype Pollution - https://npmjs.com/advisories/1500
  fix available via `npm audit fix --force`
  Will install react-scripts@4.0.3, which is a breaking change
  node_modules/webpack-dev-server/node_modules/yargs-parser
  node_modules/webpack/node_modules/yargs-parser
  node_modules/yargs-parser
    yargs  4.0.0-alpha1 - 12.0.5 || 14.1.0 || 15.0.0 - 15.2.0
    Depends on vulnerable versions of os-locale
    Depends on vulnerable versions of yargs-parser
    node_modules/webpack-dev-server/node_modules/yargs
    node_modules/webpack/node_modules/yargs
    node_modules/yargs
      jest-cli  12.1.1-alpha.2935e14d || 12.1.2-alpha.6230044c - 24.8.0
      Depends on vulnerable versions of jest-haste-map
      Depends on vulnerable versions of jest-jasmine2
      Depends on vulnerable versions of jest-message-util
      Depends on vulnerable versions of jest-snapshot
      Depends on vulnerable versions of micromatch
      Depends on vulnerable versions of yargs
      node_modules/jest-cli
        jest  18.5.0-alpha.7da3df39 - 22.4.4 || 23.4.0 - 23.6.0
        Depends on vulnerable versions of jest-cli
        node_modules/jest
          react-scripts  0.1.0 - 2.1.8
          Depends on vulnerable versions of babel-jest
          Depends on vulnerable versions of css-loader
          Depends on vulnerable versions of file-loader
          Depends on vulnerable versions of jest
          Depends on vulnerable versions of sw-precache-webpack-plugin
          Depends on vulnerable versions of webpack
          Depends on vulnerable versions of webpack-dev-server
          node_modules/react-scripts
      jest-runtime  12.1.1-alpha.2935e14d - 24.8.0
      Depends on vulnerable versions of babel-jest
      Depends on vulnerable versions of babel-plugin-istanbul
      Depends on vulnerable versions of jest-haste-map
      Depends on vulnerable versions of jest-util
      Depends on vulnerable versions of micromatch
      Depends on vulnerable versions of yargs
      node_modules/jest-runtime
      webpack  2.0.0-beta - 4.0.0-beta.3
      Depends on vulnerable versions of yargs
      node_modules/webpack
        babel-loader  7.0.0-alpha.1 - 7.1.2 || 8.0.0-beta.0 - 8.0.0-beta.6
        Depends on vulnerable versions of webpack
        node_modules/babel-loader
        extract-text-webpack-plugin  2.0.0-beta.0 - 3.0.2
        Depends on vulnerable versions of webpack
        node_modules/extract-text-webpack-plugin
        file-loader  1.1.1 - 1.1.9
        Depends on vulnerable versions of webpack
        node_modules/file-loader
        webpack-dev-server  &lt;=3.11.2
        Depends on vulnerable versions of chokidar
        Depends on vulnerable versions of http-proxy-middleware
        Depends on vulnerable versions of webpack
        Depends on vulnerable versions of yargs
        node_modules/webpack-dev-server
  </code></pre>