I am working on a project that uses @xray-app/playwright-junit-reporter and one of the dependencies “Proxy” will not update to its latest version (2.2.0). My package-lock.json contains:

"node_modules/@xray-app/playwright-junit-reporter/node_modules/proxy": {
  "version": "1.0.2",
  "resolved": "https://registry.npmjs.org/proxy/-/proxy-1.0.2.tgz",
  "integrity": "<generate hash value>",
  "dev": true,
  "license": "MIT",
  "dependencies": {
    "args": "5.0.1",
    "basic-auth-parser": "0.0.2",
    "debug": "^4.1.1"
  },
  "bin": {
    "proxy": "bin/proxy.js"
  }
},

Hence, JUnit is forced to rely on that version:

"node_modules/@xray-app/playwright-junit-reporter": {
  "version": "0.4.0",
  "resolved": "https://registry.npmjs.org/@xray-app/playwright-junit-reporter/-/playwright-junit-reporter-0.4.0.tgz",
  "integrity": "<generate hash value>",
  "dev": true,
  "license": "Apache-2.0",
  "dependencies": {
    "@babel/code-frame": "^7.21.4",
    "mime": "^3.0.0",
    **"proxy": "^1.0.2"**
  }
},

Oddly enough, the node_module has the desired version:

"node_modules/proxy": {
  "version": "2.2.0",
  "resolved": "https://registry.npmjs.org/proxy/-/proxy-2.2.0.tgz",
  "integrity": "sha512-nYclNIWj9UpXbVJ3W5EXIYiGR88AKZoGt90kyh3zoOBY5QW+7bbtPvMFgKGD4VJmpS3UXQXtlGXSg3lRNLOFLg==",
  "dev": true,
  "license": "MIT",
  "dependencies": {
    "args": "^5.0.3",
    "basic-auth-parser": "0.0.2-1",
    "debug": "^4.3.4"
  },
  "bin": {
    "proxy": "dist/bin/proxy.js"
  },
  "engines": {
    "node": ">= 14"
  }
},

…and the package.json version too:

"devDependencies": {
  "@playwright/test": "^1.49.0",
  "@types/node": "^22.5.2",
  "@xray-app/playwright-junit-reporter": "^0.4.0",
  "allure-playwright": "^3.0.6",
  "playwright": "^1.46.1",
  "proxy": "^2.2.0",
  "typescript": "^5.5.4"
},

Unfortunately, my Gitlab CI keeps flagging that version as having unacceptable vulnerability and demands a v2.2.0.

I have tried to use npm audit, npm audit fix, npm install proxy@latest, or npm cache --force and a host of other commands. I have even deleted and restored my package-lock.json but no luck.

It now looks like I have to manually change the values. Is there any risk to that (at least for the hash values)? Any other alternative method(s)?