Tarball dependency on listr-update-renderer breaks npm audit

[YannickMeeus]

Description

As part of the update to lint-staged 8.0.0, a dependency was taken on a version of listr-update-renderer not hosted in npm, but instead pulled from GitHub. This has the unfortunate side-effect that due to an issue described here (npm.community.net) and here (github.com/npm) npm audit no longer works.

I understand this very well looks like an issue that needs to be fixed in npm, but I just wanted to give you the heads-up that this is a thing, and the only workaround so far is to temporarily remove lint-staged, then npm i && npm audit fix, to then put the dependency back, which isn't great but not the end of the world either. But until either the NPM lot passes down a fix or the tarball dependency turns into an npm dependency, npm audit will not work in conjunction with lint-staged.

Steps to reproduce

N/A

Environment

• OS: macOS Mojave
• Node.js: v11.0.0
• lint-staged: 8.0.0

[okonet]

Duplicate of #511