[BUG] npm audit fix is not returning the arborist diff
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
https://github.com/npm/rfcs/issues/399
https://github.com/npm/rfcs/issues/372#issuecomment-848129245
Current Behavior
npm audit fix --json produces a summary with numbers of items added/removed/updated etc.
Expected Behavior
npm audit fix --json returns enough information to deduce:
- dependency tree path (in any reasonable form)
- package name (could be included in path)
- advisory id
- (nice to have) was it a breaking version bump
So that npm-audit-resolver and other tools could keep track of what has been fixed:
"1754|cssnano>cssnano-preset-default>postcss-svgo>svgo>css-select>css-what": {
"decision": "fix",
"madeAt": 1625857145332
},
Steps To Reproduce
- npm init -y
- npm i lodash@4.17.0
- npm audit fix --json
Environment
- OS: any
- Node: any
- npm: 7
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the npm audit fix --json flow and the Arborist diff data it currently summarizes. Reproduce the behavior with npm init -y, lodash@4.17.0, and npm audit fix --json, then compare the output with the requested dependency path, package name, and advisory ID. Done means the JSON exposes enough change information for npm-audit-resolver to track fixes.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100