Movatterモバイル変換


[0]ホーム

URL:


Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

Sign up
Appearance settings
/pnpmPublic

feat: use npm bulk audit endpoint#10322

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Draft
jasonpaulos wants to merge1 commit intopnpm:main
base:main
Choose a base branch
Loading
fromjasonpaulos:pnpm-audit-fix

Conversation

@jasonpaulos
Copy link

@jasonpaulosjasonpaulos commentedDec 15, 2025
edited
Loading

Update@pnpm/audit to use the npm bulk audit endpoint. Additionally, use the package@npmcli/metavuln-calculator to calculate meta-vulnerabilities similar to hownpm audit behavesref.

This will enable pnpm to automatically fix vulnerable dependencies similar tonpm audit fix.

Work needed:

  • Call bulk audit endpoint instead of quick audit endpoint
  • Return the results in a format similar toAuditReport from the@npmcli/arboristArborist.audit() method
  • Support for identifying force fixing opportunities, where updating a top-level dependency to a higher semver major version would resolve the vulnerability
  • Use the report to make changes to the lockfile dependency tree to fix the vulnerabilities
  • More testing

@zkochan
Copy link
Member

What is bulk audit and how does it differ from the endpoint that we currently use?

Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment

Reviewers

@zkochanzkochanAwaiting requested review from zkochanzkochan will be requested when the pull request is marked ready for reviewzkochan is a code owner

Copilot code reviewCopilotAwaiting requested review from CopilotCopilot will automatically review once the pull request is marked ready for review

At least 1 approving review is required to merge this pull request.

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@jasonpaulos@zkochan

[8]ページ先頭

©2009-2025 Movatter.jp