npm / npm/cli

[BUG] --parseable has no effect on audit

Open
#3,863 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

cmd:audit Enhancement Priority 2 Release 7.x Release 8.x
Dominant language
JavaScript
Stars
10.1k
Forks
4.7k
Avg merge
2d 2h
Merged PRs (30d)
19

Description

Is there an existing issue for this?
  • I have searched the existing issues
Current Behavior

The --parseable option has no effect on audit output

npm audit --parseable
# npm audit report

ansi-html  *
Severity: high
Uncontrolled Resource Consumption in ansi-html - https://github.com/advisories/GHSA-whgm-jr23-g3j9
No fix available
node_modules/ansi-html
  webpack-dev-server  2.0.0-beta - 4.1.0
  Depends on vulnerable versions of ansi-html
  Depends on vulnerable versions of chokidar
  Depends on vulnerable versions of http-proxy-middleware
  Depends on vulnerable versions of yargs
  node_modules/webpack-dev-server
    @angular-devkit/build-angular  <=13.0.0-next.3
    Depends on vulnerable versions of @angular-devkit/build-webpack
    Depends on vulnerable versions of webpack
    Depends on vulnerable versions of webpack-dev-server
    node_modules/@angular-devkit/build-angular
    @angular-devkit/build-webpack  <=0.1300.0-next.2
    Depends on vulnerable versions of webpack-dev-server
    node_modules/@angular-devkit/build-webpack
...
Expected Behavior

npm audit --parseable should output in a machine-readable format, as it did previously

npm audit --parseable
install set-value       high    npm install --save-dev @angular-devkit/build-angular@12.2.9     Prototype Pollution in set-value        https://github.com/advisories/GHSA-4jqc-8m5r-9rpr       @angular-devkit/build-angular>webpack>mi
cromatch>braces>snapdragon>base>cache-base>set-value    Y
install set-value       high    npm install --save-dev @angular-devkit/build-angular@12.2.9     Prototype Pollution in set-value        https://github.com/advisories/GHSA-4jqc-8m5r-9rpr       @angular-devkit/build-angular>webpack>mi
cromatch>extglob>expand-brackets>snapdragon>base>cache-base>set-value   Y
...
Steps To Reproduce
  1. npm audit --parseable
Environment
  • OS: Windows 10 20H1
  • Node: 14.15.0
  • npm: 7.24.2

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the npm audit command entry point and trace how the --parseable option is handled in npm 7.24.2. Compare its current output with the machine-readable output shown in the issue; done means npm audit --parseable produces the expected parseable audit records again.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
cli, devtools
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.