Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[BUG] npm audit fix is not returning the arborist diff #3531

Open
naugtur opened this issue Jul 9, 2021 · 0 comments
Open

[BUG] npm audit fix is not returning the arborist diff #3531

naugtur opened this issue Jul 9, 2021 · 0 comments
Labels
Bug thing that needs fixing Priority 2 secondary priority issue Release 7.x work is associated with a specific npm 7 release

Comments

@naugtur
Copy link

naugtur commented Jul 9, 2021

Is there an existing issue for this?

npm/rfcs#399
npm/rfcs#372 (comment)

Current Behavior

npm audit fix --json produces a summary with numbers of items added/removed/updated etc.

Expected Behavior

npm audit fix --json returns enough information to deduce:

  • dependency tree path (in any reasonable form)
  • package name (could be included in path)
  • advisory id
  • (nice to have) was it a breaking version bump

So that npm-audit-resolver and other tools could keep track of what has been fixed:
"1754|cssnano>cssnano-preset-default>postcss-svgo>svgo>css-select>css-what": {
"decision": "fix",
"madeAt": 1625857145332
},

Steps To Reproduce

  1. npm init -y
  2. npm i lodash@4.17.0
  3. npm audit fix --json

Environment

  • OS: any
  • Node: any
  • npm: 7
@naugtur naugtur added Bug thing that needs fixing Needs Triage needs review for next steps Release 7.x work is associated with a specific npm 7 release labels Jul 9, 2021
@nlf nlf added Priority 2 secondary priority issue and removed Needs Triage needs review for next steps labels Mar 8, 2022
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
Bug thing that needs fixing Priority 2 secondary priority issue Release 7.x work is associated with a specific npm 7 release
Projects
None yet
Development

No branches or pull requests

2 participants