[BUG] npm update -g shows audit message that wont work
Open
Nobody has claimed this yet.
Bug
Priority 2
Release 7.x
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
Not inside a repo, npm update -g says "3 moderate severity vulnerabilities".
npm update -g
removed 2 packages, changed 29 packages, and audited 259 packages in 3s
11 packages are looking for funding
run `npm fund` for details
3 moderate severity vulnerabilities
To address all issues, run:
npm audit fix
Run `npm audit` for details.
Expected Behavior
It shouldn't tell the user to run npm audit fix 'cause it will not fix the problem.
Steps To Reproduce
Tested on node.js 16.10.0, npm 7.24.1 with nvm install-latest-npm and npm update -g.
Reproducible with nvm use <other-version>, nvm uninstall node, nvm install node.
Environment
- OS: Ubuntu 20.04
- Node: 16.10.0, 16.9.1
- npm: 7.24.1
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source files or tests are named. First reproduce the global npm update -g behavior with the listed Node 16.10.0/npm 7.24.1 environment and trace where the audit message is generated; done means the output no longer recommends npm audit fix when it cannot fix the reported vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100