Skip to content

Conversation

arcanis
Copy link
Member

@arcanis arcanis commented Oct 24, 2023

What's the problem this PR addresses?

The rewrite of yarn npm audit broke a couple of things in the advisory reporting.

Fixes #5824 - The --exclude filter wasn't applied to deprecations
Fixes #5830 - The --json output was printing the raw registry output, not the filtered tree

How did you fix it?

Fixed the deprecation iterations (we were iterating the unfiltered data).

Fixed the json reporting to instead print the same tree as the one we would have displayed outside of --json. It's technically a breaking change, but it was supposed to be like that so it's probably fine to treat it as a 7.0.1 bugfix.

Added tests to prevent regressions.

Checklist

  • I have set the packages that need to be released for my changes to be effective.
  • I will check that all automated PR checks pass before the PR gets reviewed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug?]: npm audit --json output vulnerabilities that are in --ignore [Bug?]: excluding specific deprecated package doesn't work for npm audit
2 participants