Skip to content

[BUG] npm audit fix is not returning the arborist diff #3531

Open

Description

@naugtur

Is there an existing issue for this?

npm/rfcs#399
npm/rfcs#372 (comment)

Current Behavior

npm audit fix --json produces a summary with numbers of items added/removed/updated etc.

Expected Behavior

npm audit fix --json returns enough information to deduce:

  • dependency tree path (in any reasonable form)
  • package name (could be included in path)
  • advisory id
  • (nice to have) was it a breaking version bump

So that npm-audit-resolver and other tools could keep track of what has been fixed:
"1754|cssnano>cssnano-preset-default>postcss-svgo>svgo>css-select>css-what": {
"decision": "fix",
"madeAt": 1625857145332
},

Steps To Reproduce

  1. npm init -y
  2. npm i lodash@4.17.0
  3. npm audit fix --json

Environment

  • OS: any
  • Node: any
  • npm: 7

Activity

  1. added
    Bugthing that needs fixing
    Needs Triageneeds review for next steps
    Release 7.xwork is associated with a specific npm 7 release
    on Jul 9, 2021
  2. added
    Priority 2secondary priority issue
    and removed
    Needs Triageneeds review for next steps
    on Mar 8, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingPriority 2secondary priority issueRelease 7.xwork is associated with a specific npm 7 releasecmd:auditrelated to `npm audit`

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions