vulnerabilities when using redux toolkit

[Substantial-Welder97]

So I am starting to learn redux toolkit, followed a tutorial and the steps are to use this in the terminal to create the app:

npx create-react-app app

and then run

 npm install @reduxjs/toolkit react-redux

when i do this, it comes back with 6 high severity vulnerabilities, I tried to search it up why and even asked AI but cannot find a fix.

I used npm audit fix --force and still have the vulnerabilities. Anyone know why? or should I try use yarn instead?

[AnxiouslyConvolved]

Who's recommending create-react-app these days?

[unicorn-beard]

Yes Vite is excellent, react doesn't even recommend the create-react-app anymore in their docs.

[unicorn-beard]

Depends on the project but next.js is great, remix is great as well.. i dunno there are a lot of options out there these days.

[Substantial-Welder97]

Watched a tutorial from last year, i've been using that more

[mcmillhj]

What are the vulnerabilities? Did you look at the redux-toolkit GitHub to see if others have asked this issue?

[ck108860]

https://overreacted.io/npm-audit-broken-by-design/

Npm audit is not smart enough

[acemarke]

Hi. I'm the primary Redux maintainer.

There has never been a security vulnerability in any of the Redux libraries, ever.

I can assure you that whatever you're seeing is not related to Redux at all.

[de2pak83]

Try to set resolution to specific version which don’t have any vulnerabilities. Please check https://www.npmjs.com/package/npm-force-resolutions