Security vulverabilities from "tar" and "fstream" about npm

[gr2m]

neither tar nor fstream are direct dependencies of semantic-release, there is nothing we can do. You have to delete your lock file and your node_modules folder then install from scratch. It might fix the audit problems. If not, find out with npm ls tar and npm ls fstream what is preventing the dependencies to be updated or a previous version to be pinned

[ZebraFlesh]

I dug into this and found the following:

npm ls tar
[email protected] C:\Users\nope\git\nope
+-- @semantic-release/[email protected]
| `-- [email protected]
|   +-- [email protected]
|   | `-- [email protected]
|   +-- [email protected]
|   | `-- [email protected]  deduped
|   `-- [email protected]
+-- [email protected]
| `-- @jest/[email protected]
|   `-- [email protected]
|     `-- UNMET OPTIONAL DEPENDENCY [email protected]
|       `-- UNMET OPTIONAL DEPENDENCY [email protected]
|         `-- UNMET OPTIONAL DEPENDENCY [email protected]
`-- [email protected]
  `-- [email protected]
    `-- [email protected]

Doing an npm uninstall @semantic-release/npm semantic-release node-sass fixes the vulnerabilities. As soon as I npm install --save-dev @semantic-release/npm semantic-release, they come back. The issue seems to stem from the latest version of npm depending on an old version of node-gyp. :(