Can't use npm install after I updated the version of all nestjs dependencies in my package.json - npm

Question

I have created a new nestjs project and installed several additional standard packages. In the console it said that the packages are outdated and there are 7 red vulnerabilities.
The suggested command npm audit fix --force did't help - there were still 4 red vulnerabilities after that.
I found a command that updates my packages to the latest versions:
npm install -g npm-check-updates
ncu -u
npm install
Now I can't use npm install:
npm install
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR!
npm ERR! While resolving: #nestjs/typeorm#8.0.4
npm ERR! Found: typeorm#0.3.6
npm ERR! node_modules/typeorm
npm ERR! typeorm#"^0.3.6" from the root project
npm ERR!
npm ERR! Could not resolve dependency:
npm ERR! peer typeorm#"^0.2.34" from #nestjs/typeorm#8.0.4
npm ERR! node_modules/#nestjs/typeorm
npm ERR! #nestjs/typeorm#"^8.0.4" from the root project
npm ERR!
npm ERR! Conflicting peer dependency: typeorm#0.2.45
npm ERR! node_modules/typeorm
npm ERR! peer typeorm#"^0.2.34" from #nestjs/typeorm#8.0.4
npm ERR! node_modules/#nestjs/typeorm
npm ERR! #nestjs/typeorm#"^8.0.4" from the root project
npm ERR!
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force, or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
I deleted node_modules as well as the package-lock.json and then forced the installation with npm install --force. But I get again the message about severity vulnerabilities:
npm install --force
npm WARN using --force Recommended protections disabled.
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: #nestjs/typeorm#8.0.4
npm WARN Found: typeorm#0.3.6
npm WARN node_modules/typeorm
npm WARN typeorm#"^0.3.6" from the root project
npm WARN
npm WARN Could not resolve dependency:
npm WARN peer typeorm#"^0.2.34" from #nestjs/typeorm#8.0.4
npm WARN node_modules/#nestjs/typeorm
npm WARN #nestjs/typeorm#"^8.0.4" from the root project
npm WARN
npm WARN Conflicting peer dependency: typeorm#0.2.45
npm WARN node_modules/typeorm
npm WARN peer typeorm#"^0.2.34" from #nestjs/typeorm#8.0.4
npm WARN node_modules/#nestjs/typeorm
npm WARN #nestjs/typeorm#"^8.0.4" from the root project
added 823 packages, and audited 824 packages in 29s
84 packages are looking for funding
run `npm fund` for details
7 high severity vulnerabilities
To address all issues (including breaking changes), run:
npm audit fix --force
I am going in circles and do not understand how to solve the problem. And especially which version I need to use that has no red security issues?
My package.json file now looks like this:
{
"name": "api",
"version": "0.0.1",
"description": "",
"author": "",
"private": true,
"license": "UNLICENSED",
"scripts": {
"prebuild": "rimraf dist",
"build": "nest build",
"format": "prettier --write \"src/**/*.ts\" \"test/**/*.ts\"",
"start": "nest start",
"start:dev": "nest start --watch",
"start:debug": "nest start --debug --watch",
"start:prod": "node dist/main",
"lint": "eslint \"{src,apps,libs,test}/**/*.ts\" --fix",
"test": "jest",
"test:watch": "jest --watch",
"test:cov": "jest --coverage",
"test:debug": "node --inspect-brk -r tsconfig-paths/register -r ts-node/register node_modules/.bin/jest --runInBand",
"test:e2e": "jest --config ./test/jest-e2e.json"
},
"dependencies": {
"#nestjs/common": "^8.4.5",
"#nestjs/core": "^8.4.5",
"#nestjs/platform-express": "^8.4.5",
"#nestjs/typeorm": "^8.0.4",
"class-transformer": "^0.5.1",
"class-validator": "^0.13.2",
"reflect-metadata": "^0.1.13",
"rimraf": "^3.0.2",
"rxjs": "^7.5.5",
"sqlite3": "^5.0.8",
"typeorm": "^0.3.6"
},
"devDependencies": {
"#nestjs/cli": "^8.2.6",
"#nestjs/schematics": "^8.0.11",
"#nestjs/testing": "^8.4.5",
"#types/express": "^4.17.13",
"#types/jest": "27.5.1",
"#types/node": "^17.0.35",
"#types/supertest": "^2.0.12",
"#typescript-eslint/eslint-plugin": "^5.26.0",
"#typescript-eslint/parser": "^5.26.0",
"eslint": "^8.16.0",
"eslint-config-prettier": "^8.5.0",
"eslint-plugin-prettier": "^4.0.0",
"jest": "^28.1.0",
"prettier": "^2.6.2",
"source-map-support": "^0.5.21",
"supertest": "^6.2.3",
"ts-jest": "^28.0.3",
"ts-loader": "^9.3.0",
"ts-node": "^10.8.0",
"tsconfig-paths": "^4.0.0",
"typescript": "^4.7.2"
},
"jest": {
"moduleFileExtensions": [
"js",
"json",
"ts"
],
"rootDir": "src",
"testRegex": ".*\\.spec\\.ts$",
"transform": {
"^.+\\.(t|j)s$": "ts-jest"
},
"collectCoverageFrom": [
"**/*.(t|j)s"
],
"coverageDirectory": "../coverage",
"testEnvironment": "node"
}
}
Why do I get an indication that I am using typeorm#"^0.2.34" even though my package.json file specifies a newer version "typeorm": "^0.3.6"? This is also the latest version at the moment.
PS: If I change the typorm version back to 0.2.34 or 0.2, I can use npm install again but I get the red "7 high severity vulnerabilities" message.

Answer 1

Same issue for me. Using npm install --legacy-peer-deps seems to fix the issue however vulnerabilities remains.

Answer 2

Hello I just got the some problem as yours it's because the nest and npm commands getting blocked so try to allow it from Windows PowerShell by following these steps here

Answer 3

update to the latest npm version by running this command
npm i -g npm#latest