Description
Installing @wordpress/scripts package throws vulnerability errors with npm.
Terminal responds with “5 high severity issues” that appear to stemming from ws, puppeteer-core, and lighthouse.
What I’ve tried:
- Running
npm audit fix --force downgrades @wordpress/scripts to v19.2.4, unsurprisingly causing 47 other vulnerabilities.
- Using the
overrides param in package.json fixes the issue.
"overrides": {
"ws": "^8.18.0",
"lighthouse": "^12.1.0",
"puppeteer-core": "^22.13.1"
}
Step-by-step reproduction instructions
- run
npm install @wordpress/scripts or go through npx @wordpress/create-block
- run
npm audit
Screenshots, screen recording, code snippet
ws 8.0.0 - 8.17.0
Severity: high
ws affected by a DoS when handling a request with many HTTP headers - https://github.com/advisories/GHSA-3h5v-q93c-6h6q
fix available via `npm audit fix --force`
Will install @wordpress/scripts@19.2.4, which is a breaking change
node_modules/lighthouse/node_modules/puppeteer-core/node_modules/ws
node_modules/puppeteer-core/node_modules/ws
puppeteer-core 11.0.0 - 22.11.1
Depends on vulnerable versions of ws
node_modules/lighthouse/node_modules/puppeteer-core
node_modules/puppeteer-core
@wordpress/scripts >=20.0.0
Depends on vulnerable versions of @wordpress/e2e-test-utils-playwright
Depends on vulnerable versions of puppeteer-core
node_modules/@wordpress/scripts
lighthouse 9.6.1 - 11.5.0
Depends on vulnerable versions of puppeteer-core
node_modules/lighthouse
@wordpress/e2e-test-utils-playwright >=0.9.1-next.5a1d1283.0
Depends on vulnerable versions of lighthouse
node_modules/@wordpress/e2e-test-utils-playwrightEnvironment info
Unsure if this bit matters, but for what's worth:
- Tested on 2 MacBook Pros with macOS 14.5 (Sonoma) with (respectively) i9 and M1 architecture
- Node versions ^20 and ^22
- npm versions 10.7 & ^10.8.0
Please confirm that you have searched existing issues in the repo.
Please confirm that you have tested with all plugins deactivated except Gutenberg.
Description
Installing
@wordpress/scriptspackage throws vulnerability errors with npm.Terminal responds with “5 high severity issues” that appear to stemming from
ws,puppeteer-core, andlighthouse.What I’ve tried:
npm audit fix --forcedowngrades @wordpress/scripts to v19.2.4, unsurprisingly causing 47 other vulnerabilities.overridesparam inpackage.jsonfixes the issue.Step-by-step reproduction instructions
npm install @wordpress/scriptsor go throughnpx @wordpress/create-blocknpm auditScreenshots, screen recording, code snippet
Environment info
Unsure if this bit matters, but for what's worth:
Please confirm that you have searched existing issues in the repo.
Please confirm that you have tested with all plugins deactivated except Gutenberg.