<p dir="auto">Noticing a security vulnerability [<a title="CVE-2021-3807" data-hovercard-type="advisory" data-hovercard-url="/advisories/GHSA-93q8-gq69-wqmw/hovercard" href="https://github.com/advisories/GHSA-93q8-gq69-wqmw">CVE-2021-3807</a>] when scanning the "npm" package with JFrog Xray as below:</p>
<p dir="auto"><a target="_blank" rel="noopener noreferrer nofollow" href="https://user-images.githubusercontent.com/703559/151667874-2cd4456e-29f1-4514-868a-972e5cb96e77.png"><img src="https://user-images.githubusercontent.com/703559/151667874-2cd4456e-29f1-4514-868a-972e5cb96e77.png" width="500" style="max-width: 100%;"></a></p>
<p dir="auto">The package cli-table3 and one of its dependency ansi-regex need to be bumped up in order to fix this issue.</p>
<p dir="auto"><strong>Full Dependency Tree:</strong></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="test-app@1.0.0
└─┬ npm@8.3.1
  └─┬ cli-table3@0.6.0
    └─┬ string-width@4.2.2
      └─┬ strip-ansi@6.0.0
        └── ansi-regex@5.0.0 "><pre class="notranslate"><code class="notranslate">test-app@1.0.0
└─┬ npm@8.3.1
  └─┬ cli-table3@0.6.0
    └─┬ string-width@4.2.2
      └─┬ strip-ansi@6.0.0
        └── ansi-regex@5.0.0 
</code></pre></div>
<p dir="auto">This vulnerability is reported with a "High Severity".</p>
<p dir="auto">The vulnerability is fixed with ansi-regex@6.0.1</p>
<p dir="auto">Please advise.</p>
<p dir="auto">Thanks in advance.</p>
<p dir="auto">(Also see: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="1067404012" data-permission-text="Title is private" data-url="https://github.com/nodejs/node/issues/41039" data-hovercard-type="issue" data-hovercard-url="/nodejs/node/issues/41039/hovercard" href="https://github.com/nodejs/node/issues/41039">nodejs/node#41039</a>)</p>
<p dir="auto">Our team found an issue of npm inconsistent install while migrating from lerna to npm@7 workspaces. It looks like inability to install proper dependencies if there is previous state of node_modules when checking out between branches. The result differs if previous node_modules is present or not.</p>
<h3 dir="auto">Current Behavior:</h3>
<p dir="auto">The dependencies have incorrect versions after install.</p>
<h3 dir="auto">Expected Behavior:</h3>
<p dir="auto">The dependencies have correct version even after checkout between branches.</p>
<h3 dir="auto">Steps To Reproduce:</h3>
<p dir="auto">Here's git bundle (I've put it to archive because of github limitations).<br>
<a href="https://github.com/npm/cli/files/6142903/npm-7-migration-bug.bundle.zip">npm-7-migration-bug.bundle.zip</a><br>
There're two commits in branch <code class="notranslate">narrow1</code>. They display broken transition we experience. To test if dependencies are broken or not I check version of axios. It should be 0.20 on first commit and 0.21.1 on second. It version is 0.20.0 on second commit, then we have a bug.</p>
<ul dir="auto">
<li>git checkout narrow1</li>
<li>git checkout HEAD~</li>
<li>npm start # here we create initial state for node_modules</li>
<li>head ./node_modules/axios/package.json # version = 0.20.0, correct</li>
<li>git checkout -</li>
<li>npm start # here we trying to actualize state of node_modules</li>
<li>head ./node_modules/axios/package.json # version = 0.20.0, incorrect, must be = 0.21.1</li>
<li>rm -rf ./node_modules</li>
<li>npm start # running from scratch yields correct state, version = 0.21.1</li>
</ul>
<h3 dir="auto">Environment:</h3>
<p dir="auto">OS is GNU/Linux, but we have devs with the same issue on Windows machines.<br>
In repro I'm using node@12 and npm@7 for broken commit.</p>