feat(audit): add fix update mode#10341
Conversation
|
💖 Thanks for opening this pull request! 💖 |
There was a problem hiding this comment.
Pull request overview
This PR adds an experimental --fix=update mode to the audit command that fixes vulnerabilities by updating packages in the lockfile instead of adding overrides to package.json. The default behavior remains adding overrides (--fix=override).
Key changes:
- Introduces
PackageVulnerabilityAuditinterface to track and check vulnerabilities during dependency resolution - Implements version penalization in package resolution to prefer non-vulnerable versions
- Adds new
fixWithUpdatefunction that triggers dependency updates for vulnerable packages
Reviewed changes
Copilot reviewed 23 out of 25 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
packages/types/src/misc.ts |
Defines PackageVulnerabilityAudit interface and VulnerabilitySeverity enum |
resolving/npm-resolver/src/pickPackageFromMeta.ts |
Implements penalizeVulnerableVersions to assign negative weights to vulnerable version ranges |
lockfile/plugin-commands-audit/src/fixWithUpdate.ts |
New file implementing update-based vulnerability fixing |
lockfile/plugin-commands-audit/src/audit.ts |
Updates audit handler to support --fix=update and --fix=override modes |
lockfile/plugin-commands-audit/src/severity.ts |
Maps audit levels to vulnerability severity values |
lockfile/plugin-commands-audit/test/* |
Adds test coverage and refactors existing tests |
pkg-manager/*/src/* |
Threads packageVulnerabilityAudit option through dependency resolution layers |
lockfile/plugin-commands-audit/package.json |
Moves plugin-commands-installation from devDependencies to dependencies, updates Jest preset |
Files not reviewed (2)
- lockfile/plugin-commands-audit/test/fixtures/update-linear-depth-3/pnpm-lock.yaml: Language not supported
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
c44bab0 to
1b196e6
Compare
1b196e6 to
8f09065
Compare
a5a7c5c to
a44ddcd
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 32 out of 36 changed files in this pull request and generated 2 comments.
Files not reviewed (4)
- lockfile/plugin-commands-audit/test/fixtures/update-multiple/pnpm-lock.yaml: Language not supported
- lockfile/plugin-commands-audit/test/fixtures/update-single-depth-2/pnpm-lock.yaml: Language not supported
- lockfile/plugin-commands-audit/test/fixtures/update-single-depth-3/pnpm-lock.yaml: Language not supported
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
a44ddcd to
ec03ce4
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 32 out of 36 changed files in this pull request and generated 5 comments.
Files not reviewed (4)
- lockfile/plugin-commands-audit/test/fixtures/update-multiple/pnpm-lock.yaml: Language not supported
- lockfile/plugin-commands-audit/test/fixtures/update-single-depth-2/pnpm-lock.yaml: Language not supported
- lockfile/plugin-commands-audit/test/fixtures/update-single-depth-3/pnpm-lock.yaml: Language not supported
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
ec03ce4 to
f459606
Compare
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 32 out of 36 changed files in this pull request and generated 1 comment.
Files not reviewed (4)
- lockfile/plugin-commands-audit/test/fixtures/update-multiple/pnpm-lock.yaml: Language not supported
- lockfile/plugin-commands-audit/test/fixtures/update-single-depth-2/pnpm-lock.yaml: Language not supported
- lockfile/plugin-commands-audit/test/fixtures/update-single-depth-3/pnpm-lock.yaml: Language not supported
- pnpm-lock.yaml: Language not supported
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
f0ed3ef to
df470d5
Compare
|
@zkochan just checking in on this PR since it's been open for a while. I'd appreciate any feedback on what might be needed to move it forward. Thanks |
Add the ability to fix vulnerabilities by updating packages in the lockfile instead of adding overrides.
This can be invoked with
pnpm audit --fix update. Invoking with just--fixor--fix overridewill still use the old behavior of adding overrides to the package.json.Addresses the discussion from https://github.com/orgs/pnpm/discussions/9843