Component has multiple warnings with severity 'moderate' via npm audit

[iMicknl]

Version

4.14.0 (via NPM)

Describe the bug

In the custom visual that I am developing, it is not allowed to have any npm audit warning of a severity 'moderate' or higher.
It seems that there are a few due to node-fetch and sanitize-html, however I am not able to resolve them via npm audit fix as well. I didn't check the security (CVE) details yet, however I would say that it should be possible to update these dependencies in some way.

When I use npm audit fix --force, it will downgrade botframework-webchat from ^4.14.0 to ^0.15.0. And I haven't been able to understand why, yet... They mention it in the log below as well.

I am not 100% sure if this is an issue in the WebChat, or if I am doing something wrong, but I wonder if this is something someone has seen more often.

Steps to reproduce

1. git clone https://github.com/iMicknl/powerbi-botframework-chat-transcripts.git
2. cd powerbi-botframework-chat-transcripts.git
3. npm audit
4. See error
5. npm audit fix
6. See error
7. npm audit fix--force

Expected behavior

No severity moderate warning, or a way to resolve them.

Additional context

Issue after npm audit fix

 npm resolution error report

2021-07-19T15:23:28.315Z

Found: [email protected]
node_modules/microsoft-cognitiveservices-speech-sdk
  microsoft-cognitiveservices-speech-sdk@"1.17.0" from [email protected]
  node_modules/botframework-webchat
    botframework-webchat@"^4.14.0" from the root project
  microsoft-cognitiveservices-speech-sdk@"1.17.0" from [email protected]
  node_modules/botframework-directlinespeech-sdk
    botframework-directlinespeech-sdk@"4.14.0" from [email protected]
    node_modules/botframework-webchat
      botframework-webchat@"^4.14.0" from the root project

Could not resolve dependency:
peer microsoft-cognitiveservices-speech-sdk@"~1.15.0" from [email protected]
node_modules/web-speech-cognitive-services
  web-speech-cognitive-services@"7.1.0" from [email protected]
  node_modules/botframework-webchat
    botframework-webchat@"^4.14.0" from the root project
  web-speech-cognitive-services@"7.1.0" from [email protected]
  node_modules/botframework-directlinespeech-sdk
    botframework-directlinespeech-sdk@"4.14.0" from [email protected]
    node_modules/botframework-webchat
      botframework-webchat@"^4.14.0" from the root project

Fix the upstream dependency conflict, or retry
this command with --force, or --legacy-peer-deps
to accept an incorrect (and potentially broken) dependency resolution.

Output of npm audit (which mentions downgrade to 0.15.0)

node-fetch  <=2.6.0 || 3.0.0-beta.1 - 3.0.0-beta.8
Denial of Service - https://npmjs.com/advisories/1556
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/node-fetch
  cross-fetch  <=3.0.5
  Depends on vulnerable versions of node-fetch
  node_modules/cross-fetch
    botframework-directlinejs  0.11.6-master.2a17cd4 - 0.11.6-master.f5db3ed || >=0.12.0
    Depends on vulnerable versions of cross-fetch
    node_modules/botframework-directlinejs
      botframework-webchat  >=0.15.1-master.aeca50e
      Depends on vulnerable versions of botframework-directlinejs
      Depends on vulnerable versions of botframework-webchat-api
      Depends on vulnerable versions of markdown-it-attrs-es5
      Depends on vulnerable versions of sanitize-html
      node_modules/botframework-webchat

sanitize-html  <=2.3.1
Severity: moderate
Improper Input Validation - https://npmjs.com/advisories/1675
Improper Input Validation - https://npmjs.com/advisories/1676
fix available via `npm audit fix --force`
Will install [email protected], which is a breaking change
node_modules/sanitize-html
  botframework-webchat  >=0.15.1-master.aeca50e
  Depends on vulnerable versions of botframework-directlinejs
  Depends on vulnerable versions of botframework-webchat-api
  Depends on vulnerable versions of markdown-it-attrs-es5
  Depends on vulnerable versions of sanitize-html
  node_modules/botframework-webchat

21 vulnerabilities (3 low, 18 moderate)

[Bug]

[compulim]

@iMicknl 4.14.1 is out with zero production-hitting vulnerabilities (as of now). 😉

[iMicknl]

Thanks @compulim, great work :)!