+51
-3
lines changedFilter options
+51
-3
lines changed Original file line number Diff line number Diff line change
@@ -30,6 +30,13 @@ vulnerability is found. It may be useful in CI environments to include the
30 30
will cause the command to fail. This option does not filter the report
31 31
output, it simply changes the command's failure threshold.
32 32 33 +
### Package lock
34 + 35 +
By default npm requires a package-lock or shrinkwrap in order to run the
36 +
audit. You can bypass the package lock with `--no-package-lock` but be
37 +
aware the results may be different with every run, since npm will
38 +
re-build the dependency tree each time.
39 + 33 40
### Audit Signatures
34 41 35 42
To ensure the integrity of packages you download from the public npm registry, or any registry that supports signatures, you can verify the registry signatures of downloaded packages using the npm CLI.
@@ -134,6 +134,13 @@ npm query ":type(git)" | jq 'map(.name)' | xargs -I {} npm why {}
134 134
...
135 135
```
136 136 137 +
### Package lock only mode
138 + 139 +
If package-lock-only is enabled, only the information in the package
140 +
lock (or shrinkwrap) is loaded. This means that information from the
141 +
package.json files of your dependencies will not be included in the
142 +
result set (e.g. description, homepage, engines).
143 + 137 144
### Configuration
138 145 139 146
<!-- AUTOGENERATED CONFIG DESCRIPTIONS -->
@@ -404,6 +404,7 @@ class Audit extends ArboristWorkspaceCmd {
404 404
'force',
405 405
'json',
406 406
'package-lock-only',
407 +
'package-lock',
407 408
'omit',
408 409
'foreground-scripts',
409 410
'ignore-scripts',
@@ -439,6 +440,10 @@ class Audit extends ArboristWorkspaceCmd {
439 440
}
440 441 441 442
async auditAdvisories (args) {
443 +
const fix = args[0] === 'fix'
444 +
if (this.npm.config.get('package-lock') === false && fix) {
445 +
throw this.usageError('fix can not be used without a package-lock')
446 +
}
442 447
const reporter = this.npm.config.get('json') ? 'json' : 'detail'
443 448
const Arborist = require('@npmcli/arborist')
444 449
const opts = {
@@ -450,7 +455,6 @@ class Audit extends ArboristWorkspaceCmd {
450 455
}
451 456 452 457
const arb = new Arborist(opts)
453 -
const fix = args[0] === 'fix'
454 458
await arb.audit({ fix })
455 459
if (fix) {
456 460
await reifyFinish(this.npm, arb)
@@ -2552,7 +2552,7 @@ npm audit [fix|signatures]
2552 2552 2553 2553
Options:
2554 2554
[--audit-level <info|low|moderate|high|critical|none>] [--dry-run] [-f|--force]
2555 -
[--json] [--package-lock-only]
2555 +
[--json] [--package-lock-only] [--no-package-lock]
2556 2556
[--omit <dev|optional|peer> [--omit <dev|optional|peer> ...]]
2557 2557
[--foreground-scripts] [--ignore-scripts]
2558 2558
[-w|--workspace <workspace-name> [-w|--workspace <workspace-name> ...]]
@@ -2569,6 +2569,7 @@ npm audit [fix|signatures]
2569 2569
#### \`force\`
2570 2570
#### \`json\`
2571 2571
#### \`package-lock-only\`
2572 +
#### \`package-lock\`
2572 2573
#### \`omit\`
2573 2574
#### \`foreground-scripts\`
2574 2575
#### \`ignore-scripts\`
@@ -210,6 +210,18 @@ t.test('audit fix - bulk endpoint', async t => {
210 210
)
211 211
})
212 212 213 +
t.test('audit fix no package lock', async t => {
214 +
const { npm } = await loadMockNpm(t, {
215 +
config: {
216 +
'package-lock': false,
217 +
},
218 +
})
219 +
await t.rejects(
220 +
npm.exec('audit', ['fix']),
221 +
{ code: 'EUSAGE' }
222 +
)
223 +
})
224 + 213 225
t.test('completion', async t => {
214 226
const { audit } = await loadMockNpm(t, { command: 'audit' })
215 227
t.test('fix', async t => {
@@ -22,7 +22,15 @@ module.exports = cls => class Auditor extends cls {
22 22
options = { ...this.options, ...options }
23 23 24 24
process.emit('time', 'audit')
25 -
const tree = await this.loadVirtual()
25 +
let tree
26 +
if (options.packageLock === false) {
27 +
// build ideal tree
28 +
await this.loadActual(options)
29 +
await this.buildIdealTree()
30 +
tree = this.idealTree
31 +
} else {
32 +
tree = await this.loadVirtual()
33 +
}
26 34
if (this[_workspaces] && this[_workspaces].length) {
27 35
options.filterSet = this.workspaceDependencySet(
28 36
tree,
@@ -27,6 +27,15 @@ t.test('audit finds the bad deps', async t => {
27 27
t.equal(report.size, 2)
28 28
})
29 29 30 +
t.test('no package lock finds no bad deps', async t => {
31 +
const path = resolve(fixtures, 'deprecated-dep')
32 +
t.teardown(auditResponse(resolve(fixtures, 'audit-nyc-mkdirp/audit.json')))
33 +
const arb = newArb(path, { packageLock: false })
34 +
const report = await arb.audit()
35 +
t.equal(report.topVulns.size, 0)
36 +
t.equal(report.size, 0)
37 +
})
38 + 30 39
t.test('audit fix reifies out the bad deps', async t => {
31 40
const path = fixture(t, 'deprecated-dep')
32 41
t.teardown(auditResponse(resolve(fixtures, 'audit-nyc-mkdirp/audit.json')))
You can’t perform that action at this time.
RetroSearch is an open source project built by @garambo | Open a GitHub Issue
Search and Browse the WWW like it's 1997 | Search results from DuckDuckGo
HTML:
3.2
| Encoding:
UTF-8
| Version:
0.7.4