We Keep Coding

How to fix webpack-pwa-manifest vulnerability?

How to fix webpack-pwa-manifest#4.2.0 and minimist vulnerability. I tried by deleting node/modules and package-lock.json and do a fresh npm install but I have the same issue, any feedback is really appreciated.
Attached screenshots.

Actually, the issue is on minimist (webpack-pwa-manifest submodule), and it's on version 0.0.8. You can install the newest version of this module using resolution on package.json until the webpack-pwa-manifest update this module...
To add this resolution you just need to add this on you package.json:
"resolutions": { "minimist": ">=1.2.3" }
And run:
npx npm-force-resolutions && npm install

How to add npm dependency as peer dependency

Does npm have the option to install dependency as peer-dependency like yarn option --yarn, instead of adding it manually for example:
"peerDependencies": {
"#angular/core": "^7.0.0"
}
Update with more clarification of the question, thanks to #Broncha
The question is how to add a peer dependency to a project. That is
npm i dep adds the dependency to the "dependencies" in package.json,
npm i -D dep adds the dependency to the "devDependencies" in package.json.
How do I install a dependency that adds it to the "peerDependencies" in package.json?

As for now, there is NO WAY, you can install dependencies as peer-dependencies. You have to install then and manually move them to peerDependencies object in package.json
OLD ANSWER
The automatic install of peer dependencies was removed with npm v3, this feature is aging added in npm v7.
So update your npm to version 7 or higher will solve most of the problems.
If You need to install dependency as a peer dependency.
To install peer dependency, you actually need to manually modify your package.json file.
For example, if you want to install angular's core component library as a peer dependency,
npm i #angular/core
This will add a property in the dependencies object.
"dependencies": {
"#angular/core": "^7.0.0"
}
Move the installed package name to peerDependencies key.
"peerDependencies": {
"#angular/core": "^7.0.0"
}
Extra:
if you need two versions of the same package then you modify the packge.json file like this,
"peerDependencies": {
"#angular/core": "^6.0.0"
"#angular/core": "^7.0.0"
}

All the other answers are talking about How NPM command can handle installing the 'peerDeps' of the current 'deps' and 'devDeps' in package.json of current project, installing them automatically.
But the question is ask how to use NPM command with specific flag to install a deps as 'peerDeps' and write into the package.json of current project.
The ANSWER is, unfortunately, there is no such flag even till NPM#7
I guess NPM doesn't treat that a command to install deps, since adding a 'peerDeps' to package.json doesn't really need NPM to install a package to /node_modules/. It is just a file configuration change to package.json. But I understand people don't want to manually add/remove 'deps' in package.json file and want NPM to do that, it may because NPM will handle the order of the 'deps'.
Another reason is, 'peerDeps' always use a range of semver, and that has to be edit manually not via a npm install command. like react-redux:
"peerDependencies": {
"react": "^16.8.3 || ^17"
},
I think NPM#7 should provide a way to support that, since now it is officially able to process the 'peerDeps' and this feature is part of it.

you can not do it directly in npm 3 so check below reference for detials https://stackoverflow.com/a/35207983/10309265 You can do it by either way reference: https://stackoverflow.com/a/35690137/10309265

YARN/NPM: installing package versions that are compatible to certain dependency version

Let's imagine that I have the following dependencies section in package.json file:
"dependencies": {
"A": "1.0.0"
}
As well, let's assume that the current version of package A is 3.0.0. But I need version 1.0.0 of A in my project, so I explicitly specify it in package.json.
Given that, let's assume that I need to have another package B in my project that is dependent on A. The latest version of B is also 3.0.0, but it is incompatible with "A": "1.0.0". The correct version of B that is compatible with "A": "1.0.0" would be "B": "1.0.0".
The question is -
how do I detect what version of package B is compatible with "A":"1.0.0"?
Is there a way to automatically install the versions of
packages, that are dependent on A and a compatible with "A": "1.0.0"?

No. There's no way to install compatible package while installing node packages. You must specify them manually in package.json.
But, you may try the following:
Define the specific package version in package.json for only one of your main package.
Install the dependency (main package). npm install
Don't specify the dependency module version of the main package.
Install dependency. npm install DEPENDENCY_PACKAGE
This might work because as far as I remember once I had defined the main package and not its dependent package and did the preceding approach and was installed compatible version. (I had defined node engine version. But I'm not fully sure if this approach works with other packages as well.)
Just try and let me know if this works for you.

B should define its own dependency on a specific version of A, e.g. 0.0.1. In that case, when you do npm/yarn install, given you have package.json like:
"dependencies": {
"A": "1.0.0"
"B": "1.0.0"
}
A#1.0.0, B#1.0.0 will be installed,
since B declared it needs A#0.0.1,
A#0.0.1 will be installed too, but under node_modules/B.
Therefore, if the dependencies you use are well written, you should not need to manually handle these kind of problem.
More information on this behavior can be found here.

If you force the B dependencies in your project, npm install the version that you forced.
E.g.
"dependencies": {
"A": "1.0.0",
"B": "1.0.0"
}
NPM will install B 1.0.0 in your project.
To say that I tried to create a project with
...
"dependencies": {
"rxjs": "5.0.1",
"chai": "4.1.0"
},
...
Rxjs have inside the chai package dependency fixed at version 4.1.2.
I forced the 4.1.0 on my package.json and npm installed the version 4.1.0

Ran into this problem when trying to install style-loader for webpack 4.
how do I detect what version of package B is compatible with "A":"1.0.0"?
Attempting to install it using npm install style-loader tells me
npm ERR! Could not resolve dependency:
npm ERR! peer webpack#"^5.0.0" from style-loader#3.3.1
Tried decreasing the version number until the install succeeded:
npm install style-loader#\<3.3.0
npm ERR! Could not resolve dependency:
npm ERR! peer webpack#"^5.0.0" from style-loader#3.2.1
npm ERR! node_modules/style-loader
npm ERR! style-loader#"<3.3.0" from the root project
npm install style-loader#\<3.2.0 etc, until the module installed.
package.json indicates that version 2.0.0 was installed.

npm install the exact package version specified in package.json

Currently, If I run npm install, it installs the updated version of already installed packages. How can I install the exact version as specified in the package.json file?

By default npm installs packages using ^ which means any version in the same major range, you can switch this behaviour by using --save-exact
// npm
npm install --save --save-exact react
// yarn
yarn add --exact react
I created a blog post about this if anyone is looking for this in the future.
https://www.dalejefferson.com/articles/2018-02-04-how-to-save-exact-npm-package-versions/

That behavior is really driven by the one specifying the versions in the package.json. If the version number looks like "1.0.0", without any other symbols, the exact version (1.0.0) should be installed.
So what you could do is simply modify the package.json and run a npm install then. Be sure to clear out the node_modules directory before you do that.
https://docs.npmjs.com/files/package.json#dependencies

You can also open package.json and change value for the package you want to remain exact. From "vue": "^2.6.10" to "vue": "2.6.10". Notice the lack of ^ sign in front of the version number.

GRUNT - Install Grunt Packages?

Can anyone advise what I'm doing wrong here (i'm new to grunt) a colleage has supplied me with a base gruntfile setup
I have installed node,js, and grunt but I cant figure out how to install the various packages (uglify, concat etc) - which command should I use for this?

The first question you must ask yourself is, "what are the names of the grunt dependencies?"
The quick answer:
Simply execute the npm install <package-name> for each package you wish to install. For the most part, I consider the package-names to be equivalent to their github name. ( grunt-contrib-concat for example. )
npm install grunt-contrib-concat will install it, then go on to the next.
Improving Maintainability:
For optimal maintainability and cross developer/environment support you should consider using package.json to list your dependencies.
Once you have all of your dependencies listed in package.json, you can then run npm install and all of them will be installed should the need ever arise. (For development based dependency vs runtime/production based dependency management, read on!)
Best Practices:
The optimal workflow with node js is to use npm init first, so that your package.json file is created for you. then once you have a package.json, you can install each of your dependencies/devDependencies by either adding them to their respective lists in the json file or adding them to their respective lists on the fly by using npm install <package name> --save or --save dev respectivly.
NOTE: IF you are experimenting, and you'd rather NOT save a node module to your dependency list, then a simple npm install <package name> will do.
At this point, I do recommend searching for npm package.json best practices - as you will find some valuable information regarding your workflow for nodejs. Dependency management can be amazing, but only if you know how to really take advantage of the utilities provided.
Consider the following excerpt from a package.json file:
"dependencies": {
"backbone": "*",
"underscore": "~*",
"requirejs": "*"
"jquery": "*"
},
"devDependencies": {
"grunt": "*",
"grunt-contrib-uglify": "*",
"grunt-contrib-concat": "*",
"grunt-contrib-copy": "*"
},
The example we see is that the npm packages under dependencies will install when running npm install --production, the development packages will be installed automatically when running npm install --development,
NOTE: You can change your node environment as well which modifies the usage of a simple npm install with no flags.
For the most part, grunt is used for development, so I believe it would be more common to find anything related to grunt being in devDependencies
A sample package.json:
http://browsenpm.org/package.json

if you have package.json with devDependencies (or dependencies) defined, all you need to run is npm install then grunt
Otherwise run something like this to install and save them to your package.json
npm install --save-dev <package-name>