audit: report any errors above 400 as potentially not supporting audit by zkat · Pull Request #128 · npm/cli

zkat · 2018-12-19T17:34:31Z

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629
Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

simonua · 2018-12-19T18:16:32Z

This looks good to me. I think it closely gets us back to what we had before @iarna's change. Thanks, @zkat!

iarna · 2018-12-21T21:14:49Z

 }).then((auditReport) => {
 return audit.submitForFullReport(auditReport)
 }).catch((err) => {
- if (err.statusCode === 404 || err.statusCode >= 500) {


401 needs to not do this, as the main registry is (or is about to) start returning 401s when your auth data is bad, regardless of endpoint.

I would suggest that at the very least, we catch 404, 401 and then all other errors separately and tune the error messages to align better, eg:
401 - "Either your login credentials are invalid or your registry does not support audit."
404 - "Your registry does not support audit."
all other - what you have now

I've changed this to follow your suggestion. You can re-review at your convenience.

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

iarna

👍 🐑🚀💥

simonua · 2019-01-04T13:50:07Z

Thank you all very much! Looking forward to this in an upcoming release. Appreciate you, as always!

fwilhe · 2019-01-10T09:48:10Z

Thanks for this PR, I think this is an improvement as the current error message is very misleading for server errors when you have not configured any other npm registry.

Would it make sense to maybe pass the actual http status code to the message, as this might be useful for investigating errors?

Also, when will this be included in an npm release?

simonua · 2019-01-11T11:44:01Z

I verified that the messaging in 6.6.0-next.1 successfully addresses this bug. Thank you, Kat, Rebecca, and Audrey!

@zkat

#128) PR-URL: #128 Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983 Credit: @zkat Reviewed-By: @aeschright

* feat: add Linux ARM64 build targets (gnu + musl) Add aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl to cargo-dist targets, enabling prebuilt binaries for ARM64 Linux users via npm, the shell installer, and GitHub Releases. * chore: trigger CLA recheck

zkat · 2018-12-19T17:34:31Z

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629
Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

simonua · 2018-12-19T18:16:32Z

This looks good to me. I think it closely gets us back to what we had before @iarna's change. Thanks, @zkat!

iarna · 2018-12-21T21:14:49Z

 }).then((auditReport) => {
 return audit.submitForFullReport(auditReport)
 }).catch((err) => {
- if (err.statusCode === 404 || err.statusCode >= 500) {


401 needs to not do this, as the main registry is (or is about to) start returning 401s when your auth data is bad, regardless of endpoint.

I would suggest that at the very least, we catch 404, 401 and then all other errors separately and tune the error messages to align better, eg:
401 - "Either your login credentials are invalid or your registry does not support audit."
404 - "Your registry does not support audit."
all other - what you have now

I've changed this to follow your suggestion. You can re-review at your convenience.

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

iarna

👍 🐑🚀💥

simonua · 2019-01-04T13:50:07Z

Thank you all very much! Looking forward to this in an upcoming release. Appreciate you, as always!

fwilhe · 2019-01-10T09:48:10Z

Thanks for this PR, I think this is an improvement as the current error message is very misleading for server errors when you have not configured any other npm registry.

Would it make sense to maybe pass the actual http status code to the message, as this might be useful for investigating errors?

Also, when will this be included in an npm release?

simonua · 2019-01-11T11:44:01Z

I verified that the messaging in 6.6.0-next.1 successfully addresses this bug. Thank you, Kat, Rebecca, and Audrey!

@zkat

#128) PR-URL: #128 Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983 Credit: @zkat Reviewed-By: @aeschright

* feat: add Linux ARM64 build targets (gnu + musl) Add aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl to cargo-dist targets, enabling prebuilt binaries for ARM64 Linux users via npm, the shell installer, and GitHub Releases. * chore: trigger CLA recheck

zkat · 2018-12-19T17:34:31Z

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629
Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

simonua · 2018-12-19T18:16:32Z

This looks good to me. I think it closely gets us back to what we had before @iarna's change. Thanks, @zkat!

iarna · 2018-12-21T21:14:49Z

 }).then((auditReport) => {
 return audit.submitForFullReport(auditReport)
 }).catch((err) => {
- if (err.statusCode === 404 || err.statusCode >= 500) {


401 needs to not do this, as the main registry is (or is about to) start returning 401s when your auth data is bad, regardless of endpoint.

I would suggest that at the very least, we catch 404, 401 and then all other errors separately and tune the error messages to align better, eg:
401 - "Either your login credentials are invalid or your registry does not support audit."
404 - "Your registry does not support audit."
all other - what you have now

I've changed this to follow your suggestion. You can re-review at your convenience.

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

iarna

👍 🐑🚀💥

simonua · 2019-01-04T13:50:07Z

Thank you all very much! Looking forward to this in an upcoming release. Appreciate you, as always!

fwilhe · 2019-01-10T09:48:10Z

Thanks for this PR, I think this is an improvement as the current error message is very misleading for server errors when you have not configured any other npm registry.

Would it make sense to maybe pass the actual http status code to the message, as this might be useful for investigating errors?

Also, when will this be included in an npm release?

simonua · 2019-01-11T11:44:01Z

I verified that the messaging in 6.6.0-next.1 successfully addresses this bug. Thank you, Kat, Rebecca, and Audrey!

@zkat

#128) PR-URL: #128 Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983 Credit: @zkat Reviewed-By: @aeschright

* feat: add Linux ARM64 build targets (gnu + musl) Add aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl to cargo-dist targets, enabling prebuilt binaries for ARM64 Linux users via npm, the shell installer, and GitHub Releases. * chore: trigger CLA recheck

zkat · 2018-12-19T17:34:31Z

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629
Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

simonua · 2018-12-19T18:16:32Z

This looks good to me. I think it closely gets us back to what we had before @iarna's change. Thanks, @zkat!

iarna · 2018-12-21T21:14:49Z

 }).then((auditReport) => {
 return audit.submitForFullReport(auditReport)
 }).catch((err) => {
- if (err.statusCode === 404 || err.statusCode >= 500) {


401 needs to not do this, as the main registry is (or is about to) start returning 401s when your auth data is bad, regardless of endpoint.

I would suggest that at the very least, we catch 404, 401 and then all other errors separately and tune the error messages to align better, eg:
401 - "Either your login credentials are invalid or your registry does not support audit."
404 - "Your registry does not support audit."
all other - what you have now

I've changed this to follow your suggestion. You can re-review at your convenience.

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

iarna

👍 🐑🚀💥

simonua · 2019-01-04T13:50:07Z

Thank you all very much! Looking forward to this in an upcoming release. Appreciate you, as always!

fwilhe · 2019-01-10T09:48:10Z

Thanks for this PR, I think this is an improvement as the current error message is very misleading for server errors when you have not configured any other npm registry.

Would it make sense to maybe pass the actual http status code to the message, as this might be useful for investigating errors?

Also, when will this be included in an npm release?

simonua · 2019-01-11T11:44:01Z

I verified that the messaging in 6.6.0-next.1 successfully addresses this bug. Thank you, Kat, Rebecca, and Audrey!

@zkat

#128) PR-URL: #128 Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983 Credit: @zkat Reviewed-By: @aeschright

* feat: add Linux ARM64 build targets (gnu + musl) Add aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl to cargo-dist targets, enabling prebuilt binaries for ARM64 Linux users via npm, the shell installer, and GitHub Releases. * chore: trigger CLA recheck

zkat · 2018-12-19T17:34:31Z

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629
Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

simonua · 2018-12-19T18:16:32Z

This looks good to me. I think it closely gets us back to what we had before @iarna's change. Thanks, @zkat!

iarna · 2018-12-21T21:14:49Z

 }).then((auditReport) => {
 return audit.submitForFullReport(auditReport)
 }).catch((err) => {
- if (err.statusCode === 404 || err.statusCode >= 500) {


401 needs to not do this, as the main registry is (or is about to) start returning 401s when your auth data is bad, regardless of endpoint.

I would suggest that at the very least, we catch 404, 401 and then all other errors separately and tune the error messages to align better, eg:
401 - "Either your login credentials are invalid or your registry does not support audit."
404 - "Your registry does not support audit."
all other - what you have now

I've changed this to follow your suggestion. You can re-review at your convenience.

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

iarna

👍 🐑🚀💥

simonua · 2019-01-04T13:50:07Z

Thank you all very much! Looking forward to this in an upcoming release. Appreciate you, as always!

fwilhe · 2019-01-10T09:48:10Z

Thanks for this PR, I think this is an improvement as the current error message is very misleading for server errors when you have not configured any other npm registry.

Would it make sense to maybe pass the actual http status code to the message, as this might be useful for investigating errors?

Also, when will this be included in an npm release?

simonua · 2019-01-11T11:44:01Z

I verified that the messaging in 6.6.0-next.1 successfully addresses this bug. Thank you, Kat, Rebecca, and Audrey!

@zkat

#128) PR-URL: #128 Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983 Credit: @zkat Reviewed-By: @aeschright

* feat: add Linux ARM64 build targets (gnu + musl) Add aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl to cargo-dist targets, enabling prebuilt binaries for ARM64 Linux users via npm, the shell installer, and GitHub Releases. * chore: trigger CLA recheck

zkat · 2018-12-19T17:34:31Z

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629
Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

simonua · 2018-12-19T18:16:32Z

This looks good to me. I think it closely gets us back to what we had before @iarna's change. Thanks, @zkat!

iarna · 2018-12-21T21:14:49Z

 }).then((auditReport) => {
 return audit.submitForFullReport(auditReport)
 }).catch((err) => {
- if (err.statusCode === 404 || err.statusCode >= 500) {


401 needs to not do this, as the main registry is (or is about to) start returning 401s when your auth data is bad, regardless of endpoint.

I would suggest that at the very least, we catch 404, 401 and then all other errors separately and tune the error messages to align better, eg:
401 - "Either your login credentials are invalid or your registry does not support audit."
404 - "Your registry does not support audit."
all other - what you have now

I've changed this to follow your suggestion. You can re-review at your convenience.

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

iarna

👍 🐑🚀💥

simonua · 2019-01-04T13:50:07Z

Thank you all very much! Looking forward to this in an upcoming release. Appreciate you, as always!

fwilhe · 2019-01-10T09:48:10Z

Thanks for this PR, I think this is an improvement as the current error message is very misleading for server errors when you have not configured any other npm registry.

Would it make sense to maybe pass the actual http status code to the message, as this might be useful for investigating errors?

Also, when will this be included in an npm release?

simonua · 2019-01-11T11:44:01Z

I verified that the messaging in 6.6.0-next.1 successfully addresses this bug. Thank you, Kat, Rebecca, and Audrey!

@zkat

#128) PR-URL: #128 Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983 Credit: @zkat Reviewed-By: @aeschright

* feat: add Linux ARM64 build targets (gnu + musl) Add aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl to cargo-dist targets, enabling prebuilt binaries for ARM64 Linux users via npm, the shell installer, and GitHub Releases. * chore: trigger CLA recheck

zkat · 2018-12-19T17:34:31Z

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629
Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

simonua · 2018-12-19T18:16:32Z

This looks good to me. I think it closely gets us back to what we had before @iarna's change. Thanks, @zkat!

iarna · 2018-12-21T21:14:49Z

 }).then((auditReport) => {
 return audit.submitForFullReport(auditReport)
 }).catch((err) => {
- if (err.statusCode === 404 || err.statusCode >= 500) {


401 needs to not do this, as the main registry is (or is about to) start returning 401s when your auth data is bad, regardless of endpoint.

I would suggest that at the very least, we catch 404, 401 and then all other errors separately and tune the error messages to align better, eg:
401 - "Either your login credentials are invalid or your registry does not support audit."
404 - "Your registry does not support audit."
all other - what you have now

I've changed this to follow your suggestion. You can re-review at your convenience.

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

iarna

👍 🐑🚀💥

simonua · 2019-01-04T13:50:07Z

Thank you all very much! Looking forward to this in an upcoming release. Appreciate you, as always!

fwilhe · 2019-01-10T09:48:10Z

Thanks for this PR, I think this is an improvement as the current error message is very misleading for server errors when you have not configured any other npm registry.

Would it make sense to maybe pass the actual http status code to the message, as this might be useful for investigating errors?

Also, when will this be included in an npm release?

simonua · 2019-01-11T11:44:01Z

I verified that the messaging in 6.6.0-next.1 successfully addresses this bug. Thank you, Kat, Rebecca, and Audrey!

@zkat

#128) PR-URL: #128 Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983 Credit: @zkat Reviewed-By: @aeschright

* feat: add Linux ARM64 build targets (gnu + musl) Add aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl to cargo-dist targets, enabling prebuilt binaries for ARM64 Linux users via npm, the shell installer, and GitHub Releases. * chore: trigger CLA recheck

zkat · 2018-12-19T17:34:31Z

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629
Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

simonua · 2018-12-19T18:16:32Z

This looks good to me. I think it closely gets us back to what we had before @iarna's change. Thanks, @zkat!

iarna · 2018-12-21T21:14:49Z

 }).then((auditReport) => {
 return audit.submitForFullReport(auditReport)
 }).catch((err) => {
- if (err.statusCode === 404 || err.statusCode >= 500) {


401 needs to not do this, as the main registry is (or is about to) start returning 401s when your auth data is bad, regardless of endpoint.

I would suggest that at the very least, we catch 404, 401 and then all other errors separately and tune the error messages to align better, eg:
401 - "Either your login credentials are invalid or your registry does not support audit."
404 - "Your registry does not support audit."
all other - what you have now

I've changed this to follow your suggestion. You can re-review at your convenience.

Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

iarna

👍 🐑🚀💥

simonua · 2019-01-04T13:50:07Z

Thank you all very much! Looking forward to this in an upcoming release. Appreciate you, as always!

fwilhe · 2019-01-10T09:48:10Z

Thanks for this PR, I think this is an improvement as the current error message is very misleading for server errors when you have not configured any other npm registry.

Would it make sense to maybe pass the actual http status code to the message, as this might be useful for investigating errors?

Also, when will this be included in an npm release?

simonua · 2019-01-11T11:44:01Z

I verified that the messaging in 6.6.0-next.1 successfully addresses this bug. Thank you, Kat, Rebecca, and Audrey!

@zkat

#128) PR-URL: #128 Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983 Credit: @zkat Reviewed-By: @aeschright

* feat: add Linux ARM64 build targets (gnu + musl) Add aarch64-unknown-linux-gnu and aarch64-unknown-linux-musl to cargo-dist targets, enabling prebuilt binaries for ARM64 Linux users via npm, the shell installer, and GitHub Releases. * chore: trigger CLA recheck

zkat added the semver:patch semver patch level for changes label Dec 19, 2018

zkat requested a review from a team as a code owner December 19, 2018 17:34

aeschright approved these changes Dec 19, 2018
View reviewed changes

iarna suggested changes Dec 21, 2018
View reviewed changes

audit: report any errors above 400 as potentially not supporting audit
f611415
Fixes: https://npm.community/t/npm-audit-fails-with-enoaudit-on-500-response/3629 Fixes: https://npm.community/t/npm-audit-error-messaging-update-for-401s/3983

zkat force-pushed the zkat/better-audit-msg branch from 1c99673 to f611415Compare December 22, 2018 00:03

iarna approved these changes Jan 3, 2019
View reviewed changes

aeschright merged commit f58b43e into release-nextJan 9, 2019

aeschright deleted the zkat/better-audit-msg branch January 9, 2019 19:55

This was referenced May 1, 2022
[Snyk] Upgrade make-fetch-happen from 10.0.3 to 10.1.2 kevinjm39/cli#1
Open
[Snyk] Upgrade pacote from 13.0.3 to 13.1.1 kevinjm39/cli#2
Open

CALISOULB mentioned this pull request Nov 30, 2023
[Snyk] Fix for 1 vulnerabilities CALISOULB/cli#19
Open

This was referenced Nov 30, 2023
[Snyk] Security upgrade npm-registry-fetch from 9.0.0 to 14.0.0 varmakarthik12/cli#28
Closed
[Snyk] Fix for 1 vulnerabilities varmakarthik12/cli#30
Closed
[Snyk] Security upgrade npm-registry-fetch from 9.0.0 to 14.0.0 varmakarthik12/cli#31
Closed

bumplzz69 mentioned this pull request Nov 30, 2023
[Snyk] Fix for 1 vulnerabilities bumplzz69/cli#38
Open

mtdev2 mentioned this pull request Nov 30, 2023
[Snyk] Fix for 1 vulnerabilities mtdev2/cli#91
Open

Bhanditz mentioned this pull request Nov 30, 2023
[Snyk] Fix for 1 vulnerabilities Bhanditz/cli#29
Open

varmakarthik12 mentioned this pull request Nov 30, 2023
[Snyk] Fix for 1 vulnerabilities varmakarthik12/cli#38
Closed

baby636 mentioned this pull request Dec 1, 2023
[Snyk] Fix for 1 vulnerabilities baby636/cli#62
Open

varmakarthik12 mentioned this pull request Dec 1, 2023
[Snyk] Security upgrade npm-registry-fetch from 9.0.0 to 14.0.0 varmakarthik12/cli#42
Closed

MrBrain295 mentioned this pull request Dec 19, 2023
[Snyk] Fix for 3 vulnerabilities MrBrain295/cli#12
Open

CALISOULB mentioned this pull request Dec 20, 2023
[Snyk] Fix for 1 vulnerabilities CALISOULB/cli#21
Open

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 2, 2026
🤖 봇 응답 (npm#128)
049510f

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Jul 17, 2026
🔧 자동 수리 완료 (npm#128)
c154c01

coderabbitaiBot mentioned this pull request Aug 7, 2026
Support projected GeoParquet CRS overrides opengeos/GeoLibre#1766
Merged

github-actionsBot added a commit to Kevinlee7250/cli that referenced this pull request Aug 9, 2026
🔥 트렌드 선점 후보 갱신 (npm#128)
f8ecbf8

coderabbitaiBot mentioned this pull request Aug 23, 2026
fix: production-readiness pass — adapter parity, crash recovery, LLM fallback surfacing, config/store hardening fernandogarzaaa/experience-validation-engine#29
Merged
9 tasks