How to address such vulnerabilities?

[slyannah]

$ npm run update

> update
> npx npm-check-updates -u && npm install

Upgrading /home/.../package.json
[====================] 3/3 100%

All dependencies match the latest package versions :)

up to date, audited 38 packages in 1s

6 packages are looking for funding
  run `npm fund` for details

2 moderate severity vulnerabilities

To address all issues (including breaking changes), run:
  npm audit fix --force

Run `npm audit` for details.

$ npm audit fix --force
npm warn using --force Recommended protections disabled.
npm warn audit Updating @tailwindcss/typography to 0.5.4, which is a SemVer major change.

added 3 packages, removed 3 packages, changed 1 package, and audited 38 packages in 2s

6 packages are looking for funding
  run `npm fund` for details

found 0 vulnerabilities

0.5.4 does not exist.

[nicholas-greenwood]

@tailwindcss/typography@0.5.4 does exist, it's an older release. 0.5.20 is still the latest
--force lets npm audit fix install outside your declared range, and your log shows it picked the older version

the summary doesn't identify what needs fixing. if you have the earlier audit output, or the warnings return, could you share the affected package and advisory link from npm audit?

[abhiramshaji-cyber]

Both warnings are one advisory: GHSA-rj75-hqrm-r3gf in postcss-selector-parser (fixed in 6.1.5). @tailwindcss/typography@0.5.20 pins that dependency to exactly 6.0.10, so npm can't update it inside the allowed range. npm audit fix --force "fixes" it by going back to typography 0.5.4, an old release from before that dependency existed. That's why it looked like a version that doesn't exist.

Undo the downgrade and override the transitive version instead:

{
  "dependencies": {
    "@tailwindcss/typography": "^0.5.20"
  },
  "overrides": {
    "@tailwindcss/typography": {
      "postcss-selector-parser": "^6.1.5"
    }
  }
}

npm install
npm ls postcss-selector-parser   # 6.1.5
npm audit                        # found 0 vulnerabilities

I checked that prose classes still build with this override. Once typography ships a release with the bumped dependency (tracked in tailwindlabs/tailwindcss-typography#430), you can remove the override. In practice the risk is low anyway: it's a CPU exhaustion issue when parsing attacker controlled selectors at build time.

[slyannah]

I can wait for the bump.