found 1 high severity vulnerability(angular material installation)

[bestazad]

I tried to install angular material using npm install @angular/material --save but the result was:

npm WARN @angular/material@7.3.7 requires a peer of @angular/cdk@7.3.7 but none is installed. You must install peer dependencies yourself.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.9 (node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.2.9: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})

+ @angular/material@7.3.7
updated 1 package and audited 42613 packages in 16.398s
found 1 high severity vulnerability
  run `npm audit fix` to fix them, or `npm audit` for details

I also tried npm audit fix and got this result:

npm WARN @angular/material@7.3.7 requires a peer of @angular/cdk@7.3.7 but none is installed. You must install peer dependencies yourself.
npm WARN optional SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.9 (node_modules\fsevents):
npm WARN notsup SKIPPING OPTIONAL DEPENDENCY: Unsupported platform for fsevents@1.2.9: wanted {"os":"darwin","arch":"any"} (current: {"os":"win32","arch":"x64"})

up to date in 7.989s
fixed 0 of 1 vulnerability in 42613 scanned packages
  1 vulnerability required manual review and could not be updated

Then I tried nmp audit and this is the result:

                       === npm audit security report ===


                                 Manual Review
             Some vulnerabilities require your attention to resolve

          Visit https://go.npm.me/audit-guide for additional guidance


  High            Arbitrary File Overwrite

  Package         tar

  Patched in      >=4.4.2

  Dependency of   @angular-devkit/build-angular [dev]

  Path            @angular-devkit/build-angular > node-sass > node-gyp > tar

  More info       https://nodesecurity.io/advisories/803

found 1 high severity vulnerability in 42613 scanned packages
  1 vulnerability requires manual review. See the full report for details.

Why do I get this error and how can I fix it?

[blaur]

I'm seeing the exact same thing. Looking forward to some answers.

[jotatoledo]

The log is really descriptive. Please read it and try to understand it.
Is not related to the angular material package, but to the dependency tree described in the path output.

See sass/node-sass#2625

[bestazad]

The log is really descriptive. Please read it and try to understand it.
Is not related to the angular material package, but to the dependency tree described in the path output.

See sass/node-sass#2625

May you explain more please? I couldn't find a solution! Please put the exact solution if you can.

[trotyl]

Duplicate of angular/angular-cli#14138

[bestazad]

The solution of this question solved my problem too, but don't know how safe/recommended is it?
https://stackoverflow.com/questions/55635378/npm-audit-arbitrary-file-overwrite/55649551#55649551

[briancodes]

@bestazad That StackOverflow answer describes editing the package-lock.json file. That file shouldn't be manually edited, as it's auto generated

[kara]

This issue does not appear to be related to the framework itself, so closing. Please track in the existing CLI issue: angular/angular-cli#14138

[vinaysikarwar]

Anyone have the solution for this. I am also facing issue SKIPPING OPTIONAL DEPENDENCY: fsevents@1.2.9 (node_modules/fsevents) after that npm install breaks

[angular-automatic-lock-bot]

This issue has been automatically locked due to inactivity.
Please file a new issue if you are encountering a similar or related problem.

Read more about our automatic conversation locking policy.

_{This action has been performed automatically by a bot.}