Add npm audit resolve command

[naugtur]

Add means for a human to resolve issues if they can't be fixed and interactively make decisions about each issue.

See https://npm.community/t/interactive-tool-to-manage-audit-findings-npm-audit-resolve/197

I'm still hoping to discuss this, as I assume I'm not aware of all npm-cli features and modes of operation.

TODO:

• (partially done) add handling of npm configuration like prefix that I don't know how to do as of now
• make npm audit use the audit-resolv.json if present
• fix node6 support (a dependency is using ... syntax)

[zkat]

Hey @naugtur! We just met to talk about this stuff and how to handle this PR. The conclusion is a couple of points:

1. This is definitely the sort of thing we want, and it's really awesome that you took the initiative to do this. It was already on our roadmap, so it does get some level of priority. Thank you!
2. This needs a full-fledged RFC and some back-and-forth discussions between you, @evilpacket, and @iarna, so we can suss out all the little decisions and details for this thing's behavior.
3. The client library should live under the npm github org for what we consider to be security reasons, and follow our standard repo practices (which we can help you set up). Obvs, you'd be given write access to that repo :)
4. I'm going to close this specific PR because of the above decisions that need to be made, and I look forward to getting this feature into the CLI!

[naugtur]

Sounds legit.
I'll start the RFC in a day or two.

It'd be nice, since it's an interactive tool, to get some feedback from people using it in the wild. I wonder how to put my early version in front of some people as a trusted-tester stage for the resolver.
I'll include that concern in the RFC, let's not keep this thread going here.

[dead-claudia]

@naugtur Could you post a comment here once you've done that, so I can subscribe to the RFC discussion?

[naugtur]

Sure, I wanted to have it posted already, but it's a little intimidating and I feel like I need to write a lot :)

[naugtur]

The RFC is up. Hope it was worth the wait...
npm/rfcs#18

cc @isiahmeadows

[naugtur]

Add means for a human to resolve issues if they can't be fixed and interactively make decisions about each issue.

See https://npm.community/t/interactive-tool-to-manage-audit-findings-npm-audit-resolve/197

I'm still hoping to discuss this, as I assume I'm not aware of all npm-cli features and modes of operation.

TODO:

• (partially done) add handling of npm configuration like prefix that I don't know how to do as of now
• make npm audit use the audit-resolv.json if present
• fix node6 support (a dependency is using ... syntax)

[zkat]

Hey @naugtur! We just met to talk about this stuff and how to handle this PR. The conclusion is a couple of points:

1. This is definitely the sort of thing we want, and it's really awesome that you took the initiative to do this. It was already on our roadmap, so it does get some level of priority. Thank you!
2. This needs a full-fledged RFC and some back-and-forth discussions between you, @evilpacket, and @iarna, so we can suss out all the little decisions and details for this thing's behavior.
3. The client library should live under the npm github org for what we consider to be security reasons, and follow our standard repo practices (which we can help you set up). Obvs, you'd be given write access to that repo :)
4. I'm going to close this specific PR because of the above decisions that need to be made, and I look forward to getting this feature into the CLI!

[naugtur]

Sounds legit.
I'll start the RFC in a day or two.

It'd be nice, since it's an interactive tool, to get some feedback from people using it in the wild. I wonder how to put my early version in front of some people as a trusted-tester stage for the resolver.
I'll include that concern in the RFC, let's not keep this thread going here.

[dead-claudia]

@naugtur Could you post a comment here once you've done that, so I can subscribe to the RFC discussion?

[naugtur]

Sure, I wanted to have it posted already, but it's a little intimidating and I feel like I need to write a lot :)

[naugtur]

The RFC is up. Hope it was worth the wait...
npm/rfcs#18

cc @isiahmeadows

[naugtur]

Add means for a human to resolve issues if they can't be fixed and interactively make decisions about each issue.

See https://npm.community/t/interactive-tool-to-manage-audit-findings-npm-audit-resolve/197

I'm still hoping to discuss this, as I assume I'm not aware of all npm-cli features and modes of operation.

TODO:

• (partially done) add handling of npm configuration like prefix that I don't know how to do as of now
• make npm audit use the audit-resolv.json if present
• fix node6 support (a dependency is using ... syntax)

[zkat]

Hey @naugtur! We just met to talk about this stuff and how to handle this PR. The conclusion is a couple of points:

1. This is definitely the sort of thing we want, and it's really awesome that you took the initiative to do this. It was already on our roadmap, so it does get some level of priority. Thank you!
2. This needs a full-fledged RFC and some back-and-forth discussions between you, @evilpacket, and @iarna, so we can suss out all the little decisions and details for this thing's behavior.
3. The client library should live under the npm github org for what we consider to be security reasons, and follow our standard repo practices (which we can help you set up). Obvs, you'd be given write access to that repo :)
4. I'm going to close this specific PR because of the above decisions that need to be made, and I look forward to getting this feature into the CLI!

[naugtur]

Sounds legit.
I'll start the RFC in a day or two.

It'd be nice, since it's an interactive tool, to get some feedback from people using it in the wild. I wonder how to put my early version in front of some people as a trusted-tester stage for the resolver.
I'll include that concern in the RFC, let's not keep this thread going here.

[dead-claudia]

@naugtur Could you post a comment here once you've done that, so I can subscribe to the RFC discussion?

[naugtur]

Sure, I wanted to have it posted already, but it's a little intimidating and I feel like I need to write a lot :)

[naugtur]

The RFC is up. Hope it was worth the wait...
npm/rfcs#18

cc @isiahmeadows

[naugtur]

Add means for a human to resolve issues if they can't be fixed and interactively make decisions about each issue.

See https://npm.community/t/interactive-tool-to-manage-audit-findings-npm-audit-resolve/197

I'm still hoping to discuss this, as I assume I'm not aware of all npm-cli features and modes of operation.

TODO:

• (partially done) add handling of npm configuration like prefix that I don't know how to do as of now
• make npm audit use the audit-resolv.json if present
• fix node6 support (a dependency is using ... syntax)

[zkat]

Hey @naugtur! We just met to talk about this stuff and how to handle this PR. The conclusion is a couple of points:

1. This is definitely the sort of thing we want, and it's really awesome that you took the initiative to do this. It was already on our roadmap, so it does get some level of priority. Thank you!
2. This needs a full-fledged RFC and some back-and-forth discussions between you, @evilpacket, and @iarna, so we can suss out all the little decisions and details for this thing's behavior.
3. The client library should live under the npm github org for what we consider to be security reasons, and follow our standard repo practices (which we can help you set up). Obvs, you'd be given write access to that repo :)
4. I'm going to close this specific PR because of the above decisions that need to be made, and I look forward to getting this feature into the CLI!

[naugtur]

Sounds legit.
I'll start the RFC in a day or two.

It'd be nice, since it's an interactive tool, to get some feedback from people using it in the wild. I wonder how to put my early version in front of some people as a trusted-tester stage for the resolver.
I'll include that concern in the RFC, let's not keep this thread going here.

[dead-claudia]

@naugtur Could you post a comment here once you've done that, so I can subscribe to the RFC discussion?

[naugtur]

Sure, I wanted to have it posted already, but it's a little intimidating and I feel like I need to write a lot :)

[naugtur]

The RFC is up. Hope it was worth the wait...
npm/rfcs#18

cc @isiahmeadows

[naugtur]

Add means for a human to resolve issues if they can't be fixed and interactively make decisions about each issue.

See https://npm.community/t/interactive-tool-to-manage-audit-findings-npm-audit-resolve/197

I'm still hoping to discuss this, as I assume I'm not aware of all npm-cli features and modes of operation.

TODO:

• (partially done) add handling of npm configuration like prefix that I don't know how to do as of now
• make npm audit use the audit-resolv.json if present
• fix node6 support (a dependency is using ... syntax)

[zkat]

Hey @naugtur! We just met to talk about this stuff and how to handle this PR. The conclusion is a couple of points:

1. This is definitely the sort of thing we want, and it's really awesome that you took the initiative to do this. It was already on our roadmap, so it does get some level of priority. Thank you!
2. This needs a full-fledged RFC and some back-and-forth discussions between you, @evilpacket, and @iarna, so we can suss out all the little decisions and details for this thing's behavior.
3. The client library should live under the npm github org for what we consider to be security reasons, and follow our standard repo practices (which we can help you set up). Obvs, you'd be given write access to that repo :)
4. I'm going to close this specific PR because of the above decisions that need to be made, and I look forward to getting this feature into the CLI!

[naugtur]

Sounds legit.
I'll start the RFC in a day or two.

It'd be nice, since it's an interactive tool, to get some feedback from people using it in the wild. I wonder how to put my early version in front of some people as a trusted-tester stage for the resolver.
I'll include that concern in the RFC, let's not keep this thread going here.

[dead-claudia]

@naugtur Could you post a comment here once you've done that, so I can subscribe to the RFC discussion?

[naugtur]

Sure, I wanted to have it posted already, but it's a little intimidating and I feel like I need to write a lot :)

[naugtur]

The RFC is up. Hope it was worth the wait...
npm/rfcs#18

cc @isiahmeadows

[naugtur]

Add means for a human to resolve issues if they can't be fixed and interactively make decisions about each issue.

See https://npm.community/t/interactive-tool-to-manage-audit-findings-npm-audit-resolve/197

I'm still hoping to discuss this, as I assume I'm not aware of all npm-cli features and modes of operation.

TODO:

• (partially done) add handling of npm configuration like prefix that I don't know how to do as of now
• make npm audit use the audit-resolv.json if present
• fix node6 support (a dependency is using ... syntax)

[zkat]

Hey @naugtur! We just met to talk about this stuff and how to handle this PR. The conclusion is a couple of points:

1. This is definitely the sort of thing we want, and it's really awesome that you took the initiative to do this. It was already on our roadmap, so it does get some level of priority. Thank you!
2. This needs a full-fledged RFC and some back-and-forth discussions between you, @evilpacket, and @iarna, so we can suss out all the little decisions and details for this thing's behavior.
3. The client library should live under the npm github org for what we consider to be security reasons, and follow our standard repo practices (which we can help you set up). Obvs, you'd be given write access to that repo :)
4. I'm going to close this specific PR because of the above decisions that need to be made, and I look forward to getting this feature into the CLI!

[naugtur]

Sounds legit.
I'll start the RFC in a day or two.

It'd be nice, since it's an interactive tool, to get some feedback from people using it in the wild. I wonder how to put my early version in front of some people as a trusted-tester stage for the resolver.
I'll include that concern in the RFC, let's not keep this thread going here.

[dead-claudia]

@naugtur Could you post a comment here once you've done that, so I can subscribe to the RFC discussion?

[naugtur]

Sure, I wanted to have it posted already, but it's a little intimidating and I feel like I need to write a lot :)

[naugtur]

The RFC is up. Hope it was worth the wait...
npm/rfcs#18

cc @isiahmeadows

[naugtur]

Add means for a human to resolve issues if they can't be fixed and interactively make decisions about each issue.

See https://npm.community/t/interactive-tool-to-manage-audit-findings-npm-audit-resolve/197

I'm still hoping to discuss this, as I assume I'm not aware of all npm-cli features and modes of operation.

TODO:

• (partially done) add handling of npm configuration like prefix that I don't know how to do as of now
• make npm audit use the audit-resolv.json if present
• fix node6 support (a dependency is using ... syntax)

[zkat]

Hey @naugtur! We just met to talk about this stuff and how to handle this PR. The conclusion is a couple of points:

1. This is definitely the sort of thing we want, and it's really awesome that you took the initiative to do this. It was already on our roadmap, so it does get some level of priority. Thank you!
2. This needs a full-fledged RFC and some back-and-forth discussions between you, @evilpacket, and @iarna, so we can suss out all the little decisions and details for this thing's behavior.
3. The client library should live under the npm github org for what we consider to be security reasons, and follow our standard repo practices (which we can help you set up). Obvs, you'd be given write access to that repo :)
4. I'm going to close this specific PR because of the above decisions that need to be made, and I look forward to getting this feature into the CLI!

[naugtur]

Sounds legit.
I'll start the RFC in a day or two.

It'd be nice, since it's an interactive tool, to get some feedback from people using it in the wild. I wonder how to put my early version in front of some people as a trusted-tester stage for the resolver.
I'll include that concern in the RFC, let's not keep this thread going here.

[dead-claudia]

@naugtur Could you post a comment here once you've done that, so I can subscribe to the RFC discussion?

[naugtur]

Sure, I wanted to have it posted already, but it's a little intimidating and I feel like I need to write a lot :)

[naugtur]

The RFC is up. Hope it was worth the wait...
npm/rfcs#18

cc @isiahmeadows

[naugtur]

Add means for a human to resolve issues if they can't be fixed and interactively make decisions about each issue.

See https://npm.community/t/interactive-tool-to-manage-audit-findings-npm-audit-resolve/197

I'm still hoping to discuss this, as I assume I'm not aware of all npm-cli features and modes of operation.

TODO:

• (partially done) add handling of npm configuration like prefix that I don't know how to do as of now
• make npm audit use the audit-resolv.json if present
• fix node6 support (a dependency is using ... syntax)

[zkat]

Hey @naugtur! We just met to talk about this stuff and how to handle this PR. The conclusion is a couple of points:

1. This is definitely the sort of thing we want, and it's really awesome that you took the initiative to do this. It was already on our roadmap, so it does get some level of priority. Thank you!
2. This needs a full-fledged RFC and some back-and-forth discussions between you, @evilpacket, and @iarna, so we can suss out all the little decisions and details for this thing's behavior.
3. The client library should live under the npm github org for what we consider to be security reasons, and follow our standard repo practices (which we can help you set up). Obvs, you'd be given write access to that repo :)
4. I'm going to close this specific PR because of the above decisions that need to be made, and I look forward to getting this feature into the CLI!

[naugtur]

Sounds legit.
I'll start the RFC in a day or two.

It'd be nice, since it's an interactive tool, to get some feedback from people using it in the wild. I wonder how to put my early version in front of some people as a trusted-tester stage for the resolver.
I'll include that concern in the RFC, let's not keep this thread going here.

[dead-claudia]

@naugtur Could you post a comment here once you've done that, so I can subscribe to the RFC discussion?

[naugtur]

Sure, I wanted to have it posted already, but it's a little intimidating and I feel like I need to write a lot :)

[naugtur]

The RFC is up. Hope it was worth the wait...
npm/rfcs#18

cc @isiahmeadows