Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] npm audit fix is not returning the arborist diff #3531

Open
naugtur opened this issue Jul 9, 2021 · 0 comments
Open

[BUG] npm audit fix is not returning the arborist diff #3531

naugtur opened this issue Jul 9, 2021 · 0 comments
Labels
Bug thing that needs fixing Priority 2 secondary priority issue Release 7.x work is associated with a specific npm 7 release

Comments

@naugtur
Copy link

naugtur commented Jul 9, 2021

Is there an existing issue for this?

npm/rfcs#399
npm/rfcs#372 (comment)

Current Behavior

npm audit fix --json produces a summary with numbers of items added/removed/updated etc.

Expected Behavior

npm audit fix --json returns enough information to deduce:

  • dependency tree path (in any reasonable form)
  • package name (could be included in path)
  • advisory id
  • (nice to have) was it a breaking version bump

So that npm-audit-resolver and other tools could keep track of what has been fixed:
"1754|cssnano>cssnano-preset-default>postcss-svgo>svgo>css-select>css-what": {
"decision": "fix",
"madeAt": 1625857145332
},

Steps To Reproduce

  1. npm init -y
  2. npm i lodash@4.17.0
  3. npm audit fix --json

Environment

  • OS: any
  • Node: any
  • npm: 7
@naugtur naugtur added Bug thing that needs fixing Needs Triage needs review for next steps Release 7.x work is associated with a specific npm 7 release labels Jul 9, 2021
@nlf nlf added Priority 2 secondary priority issue and removed Needs Triage needs review for next steps labels Mar 8, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug thing that needs fixing Priority 2 secondary priority issue Release 7.x work is associated with a specific npm 7 release
Projects
None yet
Development

No branches or pull requests

2 participants