Run Yarn Audit on all Yarn.lock files
Open
feature-request
- Dominant language
- Go
- Stars
- 595
- Forks
- 135
- PR merge metrics
- No merged PRs in 30d
Description
It's possible for a project to have more than one `Yarn.lock` file, which is not contemplated by huskyCI nowadays, as only the `root` directory is being searched for the file.
It would be nice if huskyCI could verify the whole project for all the existing `Yarn.lock` files and analyze them all.
Contributor guide
Research direction
Start by locating the code that searches only the root directory for Yarn.lock and invokes the Yarn audit. Check how the project represents audit results, then verify that every Yarn.lock in the project is analyzed and that the combined results are reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100