[BUG] --parseable has no effect on audit
Open
Nobody has claimed this yet.
cmd:audit
Enhancement
Priority 2
Release 7.x
Release 8.x
- Dominant language
- JavaScript
- Stars
- 10.1k
- Forks
- 4.7k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 19
Description
Is there an existing issue for this?
- I have searched the existing issues
Current Behavior
The --parseable option has no effect on audit output
npm audit --parseable
# npm audit report
ansi-html *
Severity: high
Uncontrolled Resource Consumption in ansi-html - https://github.com/advisories/GHSA-whgm-jr23-g3j9
No fix available
node_modules/ansi-html
webpack-dev-server 2.0.0-beta - 4.1.0
Depends on vulnerable versions of ansi-html
Depends on vulnerable versions of chokidar
Depends on vulnerable versions of http-proxy-middleware
Depends on vulnerable versions of yargs
node_modules/webpack-dev-server
@angular-devkit/build-angular <=13.0.0-next.3
Depends on vulnerable versions of @angular-devkit/build-webpack
Depends on vulnerable versions of webpack
Depends on vulnerable versions of webpack-dev-server
node_modules/@angular-devkit/build-angular
@angular-devkit/build-webpack <=0.1300.0-next.2
Depends on vulnerable versions of webpack-dev-server
node_modules/@angular-devkit/build-webpack
...
Expected Behavior
npm audit --parseable should output in a machine-readable format, as it did previously
npm audit --parseable
install set-value high npm install --save-dev @angular-devkit/build-angular@12.2.9 Prototype Pollution in set-value https://github.com/advisories/GHSA-4jqc-8m5r-9rpr @angular-devkit/build-angular>webpack>mi
cromatch>braces>snapdragon>base>cache-base>set-value Y
install set-value high npm install --save-dev @angular-devkit/build-angular@12.2.9 Prototype Pollution in set-value https://github.com/advisories/GHSA-4jqc-8m5r-9rpr @angular-devkit/build-angular>webpack>mi
cromatch>extglob>expand-brackets>snapdragon>base>cache-base>set-value Y
...
Steps To Reproduce
npm audit --parseable
Environment
- OS: Windows 10 20H1
- Node: 14.15.0
- npm: 7.24.2
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at the npm audit command entry point and trace how the --parseable option is handled in npm 7.24.2. Compare its current output with the machine-readable output shown in the issue; done means npm audit --parseable produces the expected parseable audit records again.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, node.js
- Domain
- cli, devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100