Dependabot doesn't provide transitive dependency version

[cah-ken]

Hi,

In a dependabot alert, if it is unable to update a dependency due to a transitive dependency restriction, a message like the following will be displayed:

1.2.6 is the version on minimist where the vulnerability is fixed, however it doesn't mention what versions of mkdirp or build-angular are needed in order to remove the constraint. Is there a way, either in or outside dependabot, to determine the versions needed to fix the issue? I've looked all over but I've been unable to find a place that lists dependencies by version.

Thanks,
Ken

[cah-ken]

I've found a solution.

1. Use the following command to list the versions of a package: npm view @angular-devkit/build-angular versions
2. Run the following command, incrementing the version, until you find the version that no longer uses the vulnerable package: npx npm-remote-ls @angular-devkit/build-angular@12.2.14 | findstr ' minimist@'