3 high and 1 critical vulnerablities when using gatsby new projectname

[simon-daohang]

Hi there,
I am new to Gatsby.js and when I use gatsby new projectname to install.
It shows there are some high and critical vulnerabilities packages.
Is this OK?

I also want to ask another question here.
I just want to use Gatsby.js for my landing page and others using React.
I want to know does Gatsby.js often has conflicts with other React packages, like using Next.js?
Thanks

[LekoArts]

Hi!

While those audit messages might seem scary it doesn't show the full picture of the individual package is affected as they are not sophisticated enough to check the actual code. While we're on a old version (and at some point we'll update) of some packages, I want to highlight that those messages won't affect your finished site as nothing of that is run on the client, only during development. You can ignore those as they are not relevant to Gatsby.

I just want to use Gatsby.js for my landing page and others using React.

Gatsby is just React so any React package will work (albeit it must be ready for SSR). You can also have Create React App functionality if you use client-only paths: https://www.gatsbyjs.com/docs/how-to/routing/client-only-routes-and-user-authentication/

[jsrhodes15]

Hey @LekoArts - I completely understand where you are coming from on this, and I mostly agree with the point. The problem we are having on my team is that we run npm audit check in our CI pipeline. Now, we only fail on >high issues, but still, there are a few.

Is there any ongoing discussion as to how to alleviate this? I'm wondering if the truly "dev" dependencies can be listed as such. I know if they are devDependencies they won't be installed by npm, so that probably isn't the answer. What about the splitting the package into two parts - the code that gets added to the bundle, and the code that builds the bundle? This would allow us to list gatsby-build-thing in our devDependencies (which we also don't flag), and then gatsby would still be a regular dependency.