OSS Gate Workshop: online: 2021-10-30: kaiyu-tech: Vue CLI: Work log

[kaiyu-tech]

This is a work log of a "OSS Gate workshop".
"OSS Gate workshop" is an activity to increase OSS developers.
Here's been discussed in Japanese. Thanks.

作業ログ作成時の説明

以下のテンプレートを埋めてタイトルに設定します。埋め方例はスクロールすると見えてきます。

OSS Gate Workshop: ${LOCATION}: ${YEAR}-${MONTH}-${DAY}: ${ACCOUNT_NAME}: ${OSS_NAME}: Work log

タイトル例↓：

OSS Gate Workshop: Tokyo: 2017-01-16: kou: Rabbit: Work log

OSS Gateワークショップ関連情報

• スライド：ワークショップの進行に使っているスライドがあります。
• チャット：OSS開発に関することならなんでも相談できます。ワークショップが終わった後もオンラインで相談しながら継続的にOSSの開発に参加しましょう！
• シナリオ：ワークショップの目的・内容・進め方の詳細が書いています。
• 過去のビギナーの作業ログ：他の人の作業ログから学べることがいろいろあるはずです。

[kaiyu-tech]

Vue CLIをやってみようと思います。
https://cli.vuejs.org/

上記ページのフッターにMIT Licensedと書かれている。
https://opensource.org/licenses/alphabetical
の一覧の中に「MITライセンス」があるので、これはOSSと思われる。

[kaiyu-tech]

トップページにGetting Startedがあるのでそれを実行してみる。

[kaiyu-tech]

npm install -g @vue/cli

vue create my-project

[kaiyu-tech]

npm install -g @vue/cliを実行すると以下のようなワーニングが出る。
既におかしいような気もするのですが、もう一つのコマンドも入力してみます。

$ npm install -g @vue/cli
npm WARN deprecated @hapi/topo@3.1.6: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated @hapi/bourne@1.3.2: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated urix@0.1.0: Please see https://github.com/lydell/urix#deprecated
npm WARN deprecated har-validator@5.1.5: this library is no longer supported
npm WARN deprecated resolve-url@0.2.1: https://github.com/lydell/resolve-url#deprecated
npm WARN deprecated apollo-tracing@0.15.0: The `apollo-tracing` package is no longer part of Apollo Server 3. See https://www.apollographql.com/docs/apollo-server/migration/#tracing for details
npm WARN deprecated graphql-extensions@0.15.0: The `graphql-extensions` API has been removed from Apollo Server 3. Use the plugin API instead: https://www.apollographql.com/docs/apollo-server/integrations/plugins/
npm WARN deprecated @hapi/address@2.1.4: Moved to 'npm install @sideway/address'
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated uuid@3.4.0: Please upgrade  to version 7 or higher.  Older versions may use Math.random() in certain circumstances, which is known to be problematic.  See https://v8.dev/blog/math-random for details.
npm WARN deprecated apollo-cache-control@0.14.0: The functionality provided by the `apollo-cache-control` package is built in to `apollo-server-core` starting with Apollo Server 3. See https://www.apollographql.com/docs/apollo-server/migration/#cachecontrol for details.
npm WARN deprecated request@2.88.2: request has been deprecated, see https://github.com/request/request/issues/3142
npm WARN deprecated @hapi/hoek@8.5.1: This version has been deprecated and is no longer supported or maintained
npm WARN deprecated @hapi/joi@15.1.1: Switch to 'npm install joi'
npm WARN deprecated graphql-tools@4.0.8: This package has been deprecated and now it only exports makeExecutableSchema.\nAnd it will no longer receive updates.\nWe recommend you to migrate to scoped packages such as @graphql-tools/schema, @graphql-tools/utils and etc.\nCheck out https://www.graphql-tools.com to learn what package you should use instead

added 1 package, changed 943 packages, and audited 945 packages in 1m

65 packages are looking for funding
  run `npm fund` for details

23 vulnerabilities (4 moderate, 19 high)

To address issues that do not require attention, run:
  npm audit fix

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.

[kaiyu-tech]

Default ([Vue 2] babel, eslint)を選択しました。

$ vue create my-project


Vue CLI v4.5.15
? Please pick a preset: (Use arrow keys)
❯ Default ([Vue 2] babel, eslint) 
  Default (Vue 3) ([Vue 3] babel, eslint) 
  Manually select features 

[kaiyu-tech]

Default ([Vue 2] babel, eslint)を選択後のメッセージです。

$ vue create my-project


Vue CLI v4.5.15
? Please pick a preset: Default ([Vue 2] babel, eslint)


Vue CLI v4.5.15
✨  Creating project in ~/work/oss-gate/my-project.
🗃  Initializing git repository...
⚙️  Installing CLI plugins. This might take a while...


added 1286 packages, and audited 1287 packages in 1m

83 packages are looking for funding
  run `npm fund` for details

43 vulnerabilities (18 moderate, 25 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.
🚀  Invoking generators...
📦  Installing additional dependencies...


added 49 packages, and audited 1336 packages in 20s

88 packages are looking for funding
  run `npm fund` for details

45 vulnerabilities (20 moderate, 25 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

Run `npm audit` for details.
⚓  Running completion hooks...

📄  Generating README.md...

🎉  Successfully created project my-project.
👉  Get started with the following commands:

 $ cd my-project
 $ npm run serve

[hata6502]

npm audit fix --force を実行したときのログも、いただけるとうれしいです。

[kaiyu-tech]

メッセージに以下のようにあるので、

To address all issues possible (including breaking changes), run:
  npm audit fix --force

作成したプロジェクトのディレクトリに移動して、

$ cd my-project

以下を実行してみる。

$ npm audit fix --force

[kaiyu-tech]

実行結果として以下のようにメッセージが出る。
結果としてワーニングは解消されないようである。

$ npm audit fix --force
npm WARN using --force Recommended protections disabled.
npm WARN audit Updating eslint to 8.1.0,which is a SemVer major change.
npm WARN audit Updating @vue/cli-service to 3.12.1,which is a SemVer major change.
npm WARN audit Updating eslint-plugin-vue to 8.0.2,which is a SemVer major change.
npm WARN audit Updating @vue/cli-plugin-eslint to 3.12.1,which is a SemVer major change.
npm WARN audit Updating @vue/cli-plugin-babel to 3.12.1,which is a SemVer major change.
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-loader@2.2.1
npm WARN Found: eslint@8.1.0
npm WARN node_modules/eslint
npm WARN   dev eslint@"8.1.0" from the root project
npm WARN   3 more (babel-eslint, eslint-plugin-vue, eslint-utils)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=1.6.0 <7.0.0" from eslint-loader@2.2.1
npm WARN node_modules/eslint-loader
npm WARN   eslint-loader@"^2.1.2" from @vue/cli-plugin-eslint@3.12.1
npm WARN   node_modules/@vue/cli-plugin-eslint
npm WARN 
npm WARN Conflicting peer dependency: eslint@4.4.1
npm WARN node_modules/eslint
npm WARN   peer eslint@">=1.6.0 <7.0.0" from eslint-loader@2.2.1
npm WARN   node_modules/eslint-loader
npm WARN     eslint-loader@"^2.1.2" from @vue/cli-plugin-eslint@3.12.1
npm WARN     node_modules/@vue/cli-plugin-eslint
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: eslint-plugin-vue@4.7.1
npm WARN Found: eslint@4.19.1
npm WARN node_modules/@vue/cli-plugin-eslint/node_modules/eslint
npm WARN   optional eslint@"^4.19.1" from @vue/cli-plugin-eslint@3.12.1
npm WARN   node_modules/@vue/cli-plugin-eslint
npm WARN     dev @vue/cli-plugin-eslint@"3.12.1" from the root project
npm WARN   1 more (eslint-plugin-vue)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@"^3.18.0 || ^4.0.0" from eslint-plugin-vue@4.7.1
npm WARN node_modules/@vue/cli-plugin-eslint/node_modules/eslint-plugin-vue
npm WARN   optional eslint-plugin-vue@"^4.7.1" from @vue/cli-plugin-eslint@3.12.1
npm WARN   node_modules/@vue/cli-plugin-eslint
npm WARN 
npm WARN Conflicting peer dependency: eslint@4.4.1
npm WARN node_modules/eslint
npm WARN   peer eslint@"^3.18.0 || ^4.0.0" from eslint-plugin-vue@4.7.1
npm WARN   node_modules/@vue/cli-plugin-eslint/node_modules/eslint-plugin-vue
npm WARN     optional eslint-plugin-vue@"^4.7.1" from @vue/cli-plugin-eslint@3.12.1
npm WARN     node_modules/@vue/cli-plugin-eslint
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: vue-eslint-parser@2.0.3
npm WARN Found: eslint@4.19.1
npm WARN node_modules/@vue/cli-plugin-eslint/node_modules/eslint
npm WARN   optional eslint@"^4.19.1" from @vue/cli-plugin-eslint@3.12.1
npm WARN   node_modules/@vue/cli-plugin-eslint
npm WARN     dev @vue/cli-plugin-eslint@"3.12.1" from the root project
npm WARN   1 more (eslint-plugin-vue)
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer eslint@">=3.9.0" from vue-eslint-parser@2.0.3
npm WARN node_modules/@vue/cli-plugin-eslint/node_modules/eslint-plugin-vue/node_modules/vue-eslint-parser
npm WARN   vue-eslint-parser@"^2.0.3" from eslint-plugin-vue@4.7.1
npm WARN   node_modules/@vue/cli-plugin-eslint/node_modules/eslint-plugin-vue
npm WARN 
npm WARN Conflicting peer dependency: eslint@8.1.0
npm WARN node_modules/eslint
npm WARN   peer eslint@">=3.9.0" from vue-eslint-parser@2.0.3
npm WARN   node_modules/@vue/cli-plugin-eslint/node_modules/eslint-plugin-vue/node_modules/vue-eslint-parser
npm WARN     vue-eslint-parser@"^2.0.3" from eslint-plugin-vue@4.7.1
npm WARN     node_modules/@vue/cli-plugin-eslint/node_modules/eslint-plugin-vue
npm WARN deprecated request-promise-native@1.0.9: request-promise-native has been deprecated because it extends the now deprecated request package, see https://github.com/request/request/issues/3142
npm WARN deprecated circular-json@0.3.3: CircularJSON is in maintenance only, flatted is its successor.
npm WARN deprecated core-js@2.6.12: core-js@<3.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.
npm WARN deprecated core-js@2.6.12: core-js@<3.3 is no longer maintained and not recommended for usage due to the number of issues. Because of the V8 engine whims, feature detection in old core-js versions could cause a slowdown up to 100x even if nothing is polyfilled. Please, upgrade your dependencies to the actual version of core-js.

added 159 packages, removed 123 packages, changed 85 packages, and audited 1372 packages in 49s

88 packages are looking for funding
  run `npm fund` for details

# npm audit report

ansi-html  *
Severity: high
Uncontrolled Resource Consumption in ansi-html - https://github.com/advisories/GHSA-whgm-jr23-g3j9
No fix available
node_modules/ansi-html
  webpack-dev-server  2.0.0-beta - 4.1.0
  Depends on vulnerable versions of ansi-html
  Depends on vulnerable versions of chokidar
  Depends on vulnerable versions of http-proxy-middleware
  Depends on vulnerable versions of yargs
  node_modules/webpack-dev-server
    @vue/cli-service  <=5.0.0-beta.3
    Depends on vulnerable versions of @vue/cli-shared-utils
    Depends on vulnerable versions of cliui
    Depends on vulnerable versions of copy-webpack-plugin
    Depends on vulnerable versions of cssnano
    Depends on vulnerable versions of globby
    Depends on vulnerable versions of ora
    Depends on vulnerable versions of webpack-dev-server
    node_modules/@vue/cli-service

ansi-regex  >2.1.1 <5.0.1
Severity: moderate
 Inefficient Regular Expression Complexity in chalk/ansi-regex - https://github.com/advisories/GHSA-93q8-gq69-wqmw
No fix available
node_modules/@vue/cli-plugin-eslint/node_modules/ansi-regex
node_modules/ansi-regex
node_modules/inquirer/node_modules/ansi-regex
node_modules/table/node_modules/ansi-regex
node_modules/webpack-dev-server/node_modules/string-width/node_modules/ansi-regex
  strip-ansi  4.0.0 - 5.2.0
  Depends on vulnerable versions of ansi-regex
  node_modules/@vue/cli-plugin-eslint/node_modules/strip-ansi
  node_modules/inquirer/node_modules/strip-ansi
  node_modules/strip-ansi
  node_modules/table/node_modules/strip-ansi
  node_modules/webpack-dev-server/node_modules/string-width/node_modules/strip-ansi
    cliui  4.0.0 - 5.0.0
    Depends on vulnerable versions of strip-ansi
    Depends on vulnerable versions of wrap-ansi
    node_modules/cliui
      @vue/cli-service  <=5.0.0-beta.3
      Depends on vulnerable versions of @vue/cli-shared-utils
      Depends on vulnerable versions of cliui
      Depends on vulnerable versions of copy-webpack-plugin
      Depends on vulnerable versions of cssnano
      Depends on vulnerable versions of globby
      Depends on vulnerable versions of ora
      Depends on vulnerable versions of webpack-dev-server
      node_modules/@vue/cli-service
      yargs  10.1.0 - 15.0.0
      Depends on vulnerable versions of cliui
      Depends on vulnerable versions of string-width
      node_modules/webpack-dev-server/node_modules/yargs
        webpack-dev-server  2.0.0-beta - 4.1.0
        Depends on vulnerable versions of ansi-html
        Depends on vulnerable versions of chokidar
        Depends on vulnerable versions of http-proxy-middleware
        Depends on vulnerable versions of yargs
        node_modules/webpack-dev-server
    eslint  4.5.0 - 7.15.0
    Depends on vulnerable versions of strip-ansi
    Depends on vulnerable versions of table
    node_modules/@vue/cli-plugin-eslint/node_modules/eslint
      @vue/cli-plugin-eslint  <=5.0.0-alpha.1
      Depends on vulnerable versions of @vue/cli-shared-utils
      Depends on vulnerable versions of eslint
      Depends on vulnerable versions of globby
      node_modules/@vue/cli-plugin-eslint
    inquirer  3.2.0 - 7.0.4
    Depends on vulnerable versions of string-width
    Depends on vulnerable versions of strip-ansi
    node_modules/inquirer
    ora  2.0.0 - 4.0.2
    Depends on vulnerable versions of strip-ansi
    node_modules/ora
      @vue/cli-shared-utils  <=4.5.15
      Depends on vulnerable versions of ora
      node_modules/@vue/cli-shared-utils
        @vue/cli-plugin-babel  3.4.0 - 4.5.15
        Depends on vulnerable versions of @vue/cli-shared-utils
        node_modules/@vue/cli-plugin-babel
    string-width  2.1.0 - 4.1.0
    Depends on vulnerable versions of strip-ansi
    node_modules/cliui/node_modules/string-width
    node_modules/inquirer/node_modules/string-width
    node_modules/table/node_modules/string-width
    node_modules/webpack-dev-server/node_modules/string-width
    node_modules/wrap-ansi/node_modules/string-width
      table  4.0.2 - 5.4.6
      Depends on vulnerable versions of string-width
      node_modules/table
      wrap-ansi  3.0.0 - 6.1.0
      Depends on vulnerable versions of string-width
      Depends on vulnerable versions of strip-ansi
      node_modules/wrap-ansi

glob-parent  <5.1.2
Severity: high
Regular expression denial of service - https://github.com/advisories/GHSA-ww39-953v-wcq6
No fix available
node_modules/glob-parent
  chokidar  1.0.0-rc1 - 2.1.8
  Depends on vulnerable versions of braces
  Depends on vulnerable versions of glob-parent
  Depends on vulnerable versions of readdirp
  node_modules/watchpack-chokidar2/node_modules/chokidar
  node_modules/webpack-dev-server/node_modules/chokidar
    watchpack-chokidar2  *
    Depends on vulnerable versions of chokidar
    node_modules/watchpack-chokidar2
      watchpack  1.7.2 - 1.7.5
      Depends on vulnerable versions of watchpack-chokidar2
      node_modules/watchpack
        webpack  4.0.0-alpha.0 - 5.0.0-rc.6
        Depends on vulnerable versions of micromatch
        Depends on vulnerable versions of watchpack
        node_modules/webpack
    webpack-dev-server  2.0.0-beta - 4.1.0
    Depends on vulnerable versions of ansi-html
    Depends on vulnerable versions of chokidar
    Depends on vulnerable versions of http-proxy-middleware
    Depends on vulnerable versions of yargs
    node_modules/webpack-dev-server
      @vue/cli-service  <=5.0.0-beta.3
      Depends on vulnerable versions of @vue/cli-shared-utils
      Depends on vulnerable versions of cliui
      Depends on vulnerable versions of copy-webpack-plugin
      Depends on vulnerable versions of cssnano
      Depends on vulnerable versions of globby
      Depends on vulnerable versions of ora
      Depends on vulnerable versions of webpack-dev-server
      node_modules/@vue/cli-service
  fast-glob  <=2.2.7
  Depends on vulnerable versions of glob-parent
  Depends on vulnerable versions of micromatch
  node_modules/fast-glob
    globby  8.0.0 - 9.2.0
    Depends on vulnerable versions of fast-glob
    node_modules/globby
      @vue/cli-plugin-eslint  <=5.0.0-alpha.1
      Depends on vulnerable versions of @vue/cli-shared-utils
      Depends on vulnerable versions of eslint
      Depends on vulnerable versions of globby
      node_modules/@vue/cli-plugin-eslint

nth-check  <2.0.1
Severity: moderate
Inefficient Regular Expression Complexity in nth-check - https://github.com/advisories/GHSA-rp65-9cf3-cjxr
No fix available
node_modules/svgo/node_modules/nth-check
  css-select  <=3.1.0
  Depends on vulnerable versions of nth-check
  node_modules/svgo/node_modules/css-select
    svgo  1.0.0 - 1.3.2
    Depends on vulnerable versions of css-select
    node_modules/svgo
      postcss-svgo  4.0.0-nightly.2020.1.9 - 5.0.0-rc.2
      Depends on vulnerable versions of svgo
      node_modules/postcss-svgo
        cssnano-preset-default  <=4.0.8
        Depends on vulnerable versions of postcss-svgo
        node_modules/cssnano-preset-default
          @intervolga/optimize-cssnano-plugin  >=1.0.2
          Depends on vulnerable versions of cssnano-preset-default
          node_modules/@intervolga/optimize-cssnano-plugin
          cssnano  4.0.0-nightly.2020.1.9 - 4.1.11
          Depends on vulnerable versions of cssnano-preset-default
          node_modules/cssnano
            @vue/cli-service  <=5.0.0-beta.3
            Depends on vulnerable versions of @vue/cli-shared-utils
            Depends on vulnerable versions of cliui
            Depends on vulnerable versions of copy-webpack-plugin
            Depends on vulnerable versions of cssnano
            Depends on vulnerable versions of globby
            Depends on vulnerable versions of ora
            Depends on vulnerable versions of webpack-dev-server
            node_modules/@vue/cli-service

serialize-javascript  <=3.0.0
Severity: high
Insecure serialization leading to RCE in serialize-javascript - https://github.com/advisories/GHSA-hxcc-f52p-wc94
Cross-Site Scripting in serialize-javascript - https://github.com/advisories/GHSA-h9rv-jmmf-4pgx
No fix available
node_modules/copy-webpack-plugin/node_modules/serialize-javascript
  copy-webpack-plugin  4.3.0 - 5.1.1
  Depends on vulnerable versions of cacache
  Depends on vulnerable versions of serialize-javascript
  node_modules/copy-webpack-plugin
    @vue/cli-service  <=5.0.0-beta.3
    Depends on vulnerable versions of @vue/cli-shared-utils
    Depends on vulnerable versions of cliui
    Depends on vulnerable versions of copy-webpack-plugin
    Depends on vulnerable versions of cssnano
    Depends on vulnerable versions of globby
    Depends on vulnerable versions of ora
    Depends on vulnerable versions of webpack-dev-server
    node_modules/@vue/cli-service

set-value  <4.0.1
Severity: high
Prototype Pollution in set-value - https://github.com/advisories/GHSA-4jqc-8m5r-9rpr
No fix available
node_modules/set-value
  cache-base  >=0.7.0
  Depends on vulnerable versions of set-value
  Depends on vulnerable versions of union-value
  node_modules/cache-base
    base  >=0.7.0
    Depends on vulnerable versions of cache-base
    node_modules/base
      snapdragon  0.6.0 - 0.10.1
      Depends on vulnerable versions of base
      node_modules/snapdragon
        braces  2.0.0 - 2.3.2
        Depends on vulnerable versions of snapdragon
        node_modules/braces
          chokidar  1.0.0-rc1 - 2.1.8
          Depends on vulnerable versions of braces
          Depends on vulnerable versions of glob-parent
          Depends on vulnerable versions of readdirp
          node_modules/watchpack-chokidar2/node_modules/chokidar
          node_modules/webpack-dev-server/node_modules/chokidar
            watchpack-chokidar2  *
            Depends on vulnerable versions of chokidar
            node_modules/watchpack-chokidar2
              watchpack  1.7.2 - 1.7.5
              Depends on vulnerable versions of watchpack-chokidar2
              node_modules/watchpack
                webpack  4.0.0-alpha.0 - 5.0.0-rc.6
                Depends on vulnerable versions of micromatch
                Depends on vulnerable versions of watchpack
                node_modules/webpack
            webpack-dev-server  2.0.0-beta - 4.1.0
            Depends on vulnerable versions of ansi-html
            Depends on vulnerable versions of chokidar
            Depends on vulnerable versions of http-proxy-middleware
            Depends on vulnerable versions of yargs
            node_modules/webpack-dev-server
              @vue/cli-service  <=5.0.0-beta.3
              Depends on vulnerable versions of @vue/cli-shared-utils
              Depends on vulnerable versions of cliui
              Depends on vulnerable versions of copy-webpack-plugin
              Depends on vulnerable versions of cssnano
              Depends on vulnerable versions of globby
              Depends on vulnerable versions of ora
              Depends on vulnerable versions of webpack-dev-server
              node_modules/@vue/cli-service
        expand-brackets  1.0.0 - 2.1.4
        Depends on vulnerable versions of snapdragon
        node_modules/expand-brackets
        extglob  1.0.0 - 2.0.4
        Depends on vulnerable versions of snapdragon
        node_modules/extglob
        micromatch  3.0.0 - 3.1.10
        Depends on vulnerable versions of snapdragon
        node_modules/micromatch
          anymatch  2.0.0
          Depends on vulnerable versions of micromatch
          node_modules/watchpack-chokidar2/node_modules/anymatch
          node_modules/webpack-dev-server/node_modules/anymatch
          fast-glob  <=2.2.7
          Depends on vulnerable versions of glob-parent
          Depends on vulnerable versions of micromatch
          node_modules/fast-glob
            globby  8.0.0 - 9.2.0
            Depends on vulnerable versions of fast-glob
            node_modules/globby
              @vue/cli-plugin-eslint  <=5.0.0-alpha.1
              Depends on vulnerable versions of @vue/cli-shared-utils
              Depends on vulnerable versions of eslint
              Depends on vulnerable versions of globby
              node_modules/@vue/cli-plugin-eslint
          http-proxy-middleware  0.18.0 - 0.19.2
          Depends on vulnerable versions of micromatch
          node_modules/http-proxy-middleware
          readdirp  2.2.0 - 2.2.1
          Depends on vulnerable versions of micromatch
          node_modules/watchpack-chokidar2/node_modules/readdirp
          node_modules/webpack-dev-server/node_modules/readdirp
        nanomatch  >=0.1.1
        Depends on vulnerable versions of snapdragon
        node_modules/nanomatch
  union-value  *
  Depends on vulnerable versions of set-value
  node_modules/union-value

ssri  5.2.2 - 6.0.1
Severity: high
Regular Expression Denial of Service (ReDoS) - https://github.com/advisories/GHSA-vx3p-948g-6vhq
No fix available
node_modules/copy-webpack-plugin/node_modules/ssri
  cacache  10.0.4 - 11.0.0
  Depends on vulnerable versions of ssri
  node_modules/copy-webpack-plugin/node_modules/cacache
    copy-webpack-plugin  4.3.0 - 5.1.1
    Depends on vulnerable versions of cacache
    Depends on vulnerable versions of serialize-javascript
    node_modules/copy-webpack-plugin
      @vue/cli-service  <=5.0.0-beta.3
      Depends on vulnerable versions of @vue/cli-shared-utils
      Depends on vulnerable versions of cliui
      Depends on vulnerable versions of copy-webpack-plugin
      Depends on vulnerable versions of cssnano
      Depends on vulnerable versions of globby
      Depends on vulnerable versions of ora
      Depends on vulnerable versions of webpack-dev-server
      node_modules/@vue/cli-service

47 vulnerabilities (19 moderate, 28 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.

[kaiyu-tech]

npm audit fix --force を実行したときのログも、いただけるとうれしいです。

上記についてのログも追加しました！

[kaiyu-tech]

npm audit fix --forceを実行しても、結果としてワーニングが解消しないのは問題であると思われる。

[kaiyu-tech]

#1492 (comment)
vue create my-projectを実行した時のログの最後に、

npm run serve

とあるのでとりあえず実行してみる。

[kaiyu-tech]

ERROR Failed to compile with 1 errors
TypeError: eslint.CLIEngine is not a constructor
と言うエラーが出てしまう。

$ npm run serve

> my-project@0.1.0 serve
> vue-cli-service serve

 INFO  Starting development server...
98% after emitting CopyPlugin

 ERROR  Failed to compile with 1 errors                                                                                                                                                    11:48:11

Module build failed (from ./node_modules/eslint-loader/index.js):
TypeError: eslint.CLIEngine is not a constructor
    at Object.module.exports (~/work/oss-gate/my-project/node_modules/eslint-loader/index.js:223:27)

You may use special comments to disable some warnings.
Use // eslint-disable-next-line to ignore the next line.
Use /* eslint-disable */ to ignore all warnings in a file.

[kaiyu-tech]

nodeとnpmのバージョンも確認しておくと良いとサポーターさんにアドバイスいただいたので確認しました。

$ node -v
v16.9.0

$ npm -v
7.21.1

念の為vueのバージョンも確認しました。

$ vue -V
@vue/cli 4.5.15

[kaiyu-tech]

nodeとnpmがどこにインストールされているか（何を通してインストールしたか）を確認すると良いとアドバイスいただいたので確認しました。

$ which node
~/.nvm/versions/node/v16.9.0/bin/node

$ which npm 
~/.nvm/versions/node/v16.9.0/bin/npm