feature: configurable audit level by lennym · Pull Request #31 · npm/cli

lennym · 2018-07-27T08:27:21Z

This is a port of my old PR at npm/npm#20992

It allows npm audit to exit with a zero exit code if only vulnerabilities below a defined threshold are detected. The default is left at low so it should be wholly non-breaking.

More discussion at https://npm.community/t/allow-a-configurable-vuln-level-to-make-npm-audit-fail/245/5

`npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found. Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.

zkat

I'm 👍 on this one, specially since all it does is modify the loglevel for failure. I'd like to get sign-off from @iarna and @npm/security-product to make sure this aligns with their ideas around audit, and the rest looks great. Thanks for writing tests and doing such a nicely-targeted feature! 🎉

zkat · 2018-07-30T21:28:44Z

p.s. feel free to ignore the CI failure. It's unrelated to your PR.

evilpacket · 2018-07-30T21:33:39Z

I'm 👍 on this as it's a desired user feature to only break on certain levels of vulns and brings us closer to feature parity with legacy nsp

zkat

LGTM, then! Woo!

I have created a wrapper for it, because `npm audit` itself _always_ fails if _any_ vulnerabilities are present, and we don't want to fail on low or moderate vulnerabilities. This issue has been PR'ed in npm, so if/when npm/cli#31 is merged and released then the command can be swapped for a basic `npm audit`.

implementation added in npm#31

implementation added in #31

npm#33) * feat(error): detect accessNotConfigured and guide users to enable APIs When the Google API returns a 403 with reason accessNotConfigured, gws now: - Extracts the GCP Console enable URL from the error message. - Adds an optional enable_url field to the JSON error output. - Prints an actionable hint with the enable URL to stderr. Also adds extract_enable_url() helper with tests, and a Troubleshooting section to README. Fixesnpm#31 * fix(error): trim trailing punctuation from accessNotConfigured enable URL

lennym · 2018-07-27T08:27:21Z

This is a port of my old PR at npm/npm#20992

It allows npm audit to exit with a zero exit code if only vulnerabilities below a defined threshold are detected. The default is left at low so it should be wholly non-breaking.

More discussion at https://npm.community/t/allow-a-configurable-vuln-level-to-make-npm-audit-fail/245/5

`npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found. Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.

zkat

I'm 👍 on this one, specially since all it does is modify the loglevel for failure. I'd like to get sign-off from @iarna and @npm/security-product to make sure this aligns with their ideas around audit, and the rest looks great. Thanks for writing tests and doing such a nicely-targeted feature! 🎉

zkat · 2018-07-30T21:28:44Z

p.s. feel free to ignore the CI failure. It's unrelated to your PR.

evilpacket · 2018-07-30T21:33:39Z

I'm 👍 on this as it's a desired user feature to only break on certain levels of vulns and brings us closer to feature parity with legacy nsp

zkat

LGTM, then! Woo!

I have created a wrapper for it, because `npm audit` itself _always_ fails if _any_ vulnerabilities are present, and we don't want to fail on low or moderate vulnerabilities. This issue has been PR'ed in npm, so if/when npm/cli#31 is merged and released then the command can be swapped for a basic `npm audit`.

implementation added in npm#31

implementation added in #31

npm#33) * feat(error): detect accessNotConfigured and guide users to enable APIs When the Google API returns a 403 with reason accessNotConfigured, gws now: - Extracts the GCP Console enable URL from the error message. - Adds an optional enable_url field to the JSON error output. - Prints an actionable hint with the enable URL to stderr. Also adds extract_enable_url() helper with tests, and a Troubleshooting section to README. Fixesnpm#31 * fix(error): trim trailing punctuation from accessNotConfigured enable URL

lennym · 2018-07-27T08:27:21Z

This is a port of my old PR at npm/npm#20992

It allows npm audit to exit with a zero exit code if only vulnerabilities below a defined threshold are detected. The default is left at low so it should be wholly non-breaking.

More discussion at https://npm.community/t/allow-a-configurable-vuln-level-to-make-npm-audit-fail/245/5

`npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found. Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.

zkat

I'm 👍 on this one, specially since all it does is modify the loglevel for failure. I'd like to get sign-off from @iarna and @npm/security-product to make sure this aligns with their ideas around audit, and the rest looks great. Thanks for writing tests and doing such a nicely-targeted feature! 🎉

zkat · 2018-07-30T21:28:44Z

p.s. feel free to ignore the CI failure. It's unrelated to your PR.

evilpacket · 2018-07-30T21:33:39Z

I'm 👍 on this as it's a desired user feature to only break on certain levels of vulns and brings us closer to feature parity with legacy nsp

zkat

LGTM, then! Woo!

I have created a wrapper for it, because `npm audit` itself _always_ fails if _any_ vulnerabilities are present, and we don't want to fail on low or moderate vulnerabilities. This issue has been PR'ed in npm, so if/when npm/cli#31 is merged and released then the command can be swapped for a basic `npm audit`.

implementation added in npm#31

implementation added in #31

npm#33) * feat(error): detect accessNotConfigured and guide users to enable APIs When the Google API returns a 403 with reason accessNotConfigured, gws now: - Extracts the GCP Console enable URL from the error message. - Adds an optional enable_url field to the JSON error output. - Prints an actionable hint with the enable URL to stderr. Also adds extract_enable_url() helper with tests, and a Troubleshooting section to README. Fixesnpm#31 * fix(error): trim trailing punctuation from accessNotConfigured enable URL

lennym · 2018-07-27T08:27:21Z

This is a port of my old PR at npm/npm#20992

It allows npm audit to exit with a zero exit code if only vulnerabilities below a defined threshold are detected. The default is left at low so it should be wholly non-breaking.

More discussion at https://npm.community/t/allow-a-configurable-vuln-level-to-make-npm-audit-fail/245/5

`npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found. Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.

zkat

I'm 👍 on this one, specially since all it does is modify the loglevel for failure. I'd like to get sign-off from @iarna and @npm/security-product to make sure this aligns with their ideas around audit, and the rest looks great. Thanks for writing tests and doing such a nicely-targeted feature! 🎉

zkat · 2018-07-30T21:28:44Z

p.s. feel free to ignore the CI failure. It's unrelated to your PR.

evilpacket · 2018-07-30T21:33:39Z

I'm 👍 on this as it's a desired user feature to only break on certain levels of vulns and brings us closer to feature parity with legacy nsp

zkat

LGTM, then! Woo!

I have created a wrapper for it, because `npm audit` itself _always_ fails if _any_ vulnerabilities are present, and we don't want to fail on low or moderate vulnerabilities. This issue has been PR'ed in npm, so if/when npm/cli#31 is merged and released then the command can be swapped for a basic `npm audit`.

implementation added in npm#31

implementation added in #31

npm#33) * feat(error): detect accessNotConfigured and guide users to enable APIs When the Google API returns a 403 with reason accessNotConfigured, gws now: - Extracts the GCP Console enable URL from the error message. - Adds an optional enable_url field to the JSON error output. - Prints an actionable hint with the enable URL to stderr. Also adds extract_enable_url() helper with tests, and a Troubleshooting section to README. Fixesnpm#31 * fix(error): trim trailing punctuation from accessNotConfigured enable URL

lennym · 2018-07-27T08:27:21Z

This is a port of my old PR at npm/npm#20992

It allows npm audit to exit with a zero exit code if only vulnerabilities below a defined threshold are detected. The default is left at low so it should be wholly non-breaking.

More discussion at https://npm.community/t/allow-a-configurable-vuln-level-to-make-npm-audit-fail/245/5

`npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found. Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.

zkat

I'm 👍 on this one, specially since all it does is modify the loglevel for failure. I'd like to get sign-off from @iarna and @npm/security-product to make sure this aligns with their ideas around audit, and the rest looks great. Thanks for writing tests and doing such a nicely-targeted feature! 🎉

zkat · 2018-07-30T21:28:44Z

p.s. feel free to ignore the CI failure. It's unrelated to your PR.

evilpacket · 2018-07-30T21:33:39Z

I'm 👍 on this as it's a desired user feature to only break on certain levels of vulns and brings us closer to feature parity with legacy nsp

zkat

LGTM, then! Woo!

I have created a wrapper for it, because `npm audit` itself _always_ fails if _any_ vulnerabilities are present, and we don't want to fail on low or moderate vulnerabilities. This issue has been PR'ed in npm, so if/when npm/cli#31 is merged and released then the command can be swapped for a basic `npm audit`.

implementation added in npm#31

implementation added in #31

npm#33) * feat(error): detect accessNotConfigured and guide users to enable APIs When the Google API returns a 403 with reason accessNotConfigured, gws now: - Extracts the GCP Console enable URL from the error message. - Adds an optional enable_url field to the JSON error output. - Prints an actionable hint with the enable URL to stderr. Also adds extract_enable_url() helper with tests, and a Troubleshooting section to README. Fixesnpm#31 * fix(error): trim trailing punctuation from accessNotConfigured enable URL

lennym · 2018-07-27T08:27:21Z

This is a port of my old PR at npm/npm#20992

It allows npm audit to exit with a zero exit code if only vulnerabilities below a defined threshold are detected. The default is left at low so it should be wholly non-breaking.

More discussion at https://npm.community/t/allow-a-configurable-vuln-level-to-make-npm-audit-fail/245/5

`npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found. Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.

zkat

I'm 👍 on this one, specially since all it does is modify the loglevel for failure. I'd like to get sign-off from @iarna and @npm/security-product to make sure this aligns with their ideas around audit, and the rest looks great. Thanks for writing tests and doing such a nicely-targeted feature! 🎉

zkat · 2018-07-30T21:28:44Z

p.s. feel free to ignore the CI failure. It's unrelated to your PR.

evilpacket · 2018-07-30T21:33:39Z

I'm 👍 on this as it's a desired user feature to only break on certain levels of vulns and brings us closer to feature parity with legacy nsp

zkat

LGTM, then! Woo!

I have created a wrapper for it, because `npm audit` itself _always_ fails if _any_ vulnerabilities are present, and we don't want to fail on low or moderate vulnerabilities. This issue has been PR'ed in npm, so if/when npm/cli#31 is merged and released then the command can be swapped for a basic `npm audit`.

implementation added in npm#31

implementation added in #31

npm#33) * feat(error): detect accessNotConfigured and guide users to enable APIs When the Google API returns a 403 with reason accessNotConfigured, gws now: - Extracts the GCP Console enable URL from the error message. - Adds an optional enable_url field to the JSON error output. - Prints an actionable hint with the enable URL to stderr. Also adds extract_enable_url() helper with tests, and a Troubleshooting section to README. Fixesnpm#31 * fix(error): trim trailing punctuation from accessNotConfigured enable URL

lennym · 2018-07-27T08:27:21Z

This is a port of my old PR at npm/npm#20992

It allows npm audit to exit with a zero exit code if only vulnerabilities below a defined threshold are detected. The default is left at low so it should be wholly non-breaking.

More discussion at https://npm.community/t/allow-a-configurable-vuln-level-to-make-npm-audit-fail/245/5

`npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found. Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.

zkat

I'm 👍 on this one, specially since all it does is modify the loglevel for failure. I'd like to get sign-off from @iarna and @npm/security-product to make sure this aligns with their ideas around audit, and the rest looks great. Thanks for writing tests and doing such a nicely-targeted feature! 🎉

zkat · 2018-07-30T21:28:44Z

p.s. feel free to ignore the CI failure. It's unrelated to your PR.

evilpacket · 2018-07-30T21:33:39Z

I'm 👍 on this as it's a desired user feature to only break on certain levels of vulns and brings us closer to feature parity with legacy nsp

zkat

LGTM, then! Woo!

I have created a wrapper for it, because `npm audit` itself _always_ fails if _any_ vulnerabilities are present, and we don't want to fail on low or moderate vulnerabilities. This issue has been PR'ed in npm, so if/when npm/cli#31 is merged and released then the command can be swapped for a basic `npm audit`.

implementation added in npm#31

implementation added in #31

npm#33) * feat(error): detect accessNotConfigured and guide users to enable APIs When the Google API returns a 403 with reason accessNotConfigured, gws now: - Extracts the GCP Console enable URL from the error message. - Adds an optional enable_url field to the JSON error output. - Prints an actionable hint with the enable URL to stderr. Also adds extract_enable_url() helper with tests, and a Troubleshooting section to README. Fixesnpm#31 * fix(error): trim trailing punctuation from accessNotConfigured enable URL

lennym · 2018-07-27T08:27:21Z

This is a port of my old PR at npm/npm#20992

It allows npm audit to exit with a zero exit code if only vulnerabilities below a defined threshold are detected. The default is left at low so it should be wholly non-breaking.

More discussion at https://npm.community/t/allow-a-configurable-vuln-level-to-make-npm-audit-fail/245/5

`npm audit` currently exits with exit code 1 if any vulnerabilities are found of any level. Add a flag of `--audit-level` to `npm audit` to allow it to pass if only vulnerabilities below a certain level are found. Example: `npm audit --audit-level=high` will exit with 0 if only low or moderate level vulns are detected.

zkat

I'm 👍 on this one, specially since all it does is modify the loglevel for failure. I'd like to get sign-off from @iarna and @npm/security-product to make sure this aligns with their ideas around audit, and the rest looks great. Thanks for writing tests and doing such a nicely-targeted feature! 🎉

zkat · 2018-07-30T21:28:44Z

p.s. feel free to ignore the CI failure. It's unrelated to your PR.

evilpacket · 2018-07-30T21:33:39Z

I'm 👍 on this as it's a desired user feature to only break on certain levels of vulns and brings us closer to feature parity with legacy nsp

zkat

LGTM, then! Woo!

I have created a wrapper for it, because `npm audit` itself _always_ fails if _any_ vulnerabilities are present, and we don't want to fail on low or moderate vulnerabilities. This issue has been PR'ed in npm, so if/when npm/cli#31 is merged and released then the command can be swapped for a basic `npm audit`.

implementation added in npm#31

implementation added in #31

npm#33) * feat(error): detect accessNotConfigured and guide users to enable APIs When the Google API returns a 403 with reason accessNotConfigured, gws now: - Extracts the GCP Console enable URL from the error message. - Adds an optional enable_url field to the JSON error output. - Prints an actionable hint with the enable URL to stderr. Also adds extract_enable_url() helper with tests, and a Troubleshooting section to README. Fixesnpm#31 * fix(error): trim trailing punctuation from accessNotConfigured enable URL

lennym added 3 commits June 14, 2018 16:58

Add documentation for proposed audit-level config
f2f5692

Add tests for audit exit code based on audit-level flag
0aca665

lennym requested a review from a team as a code owner July 27, 2018 08:27

zkat added semver:minor new backwards-compatible feature security labels Jul 30, 2018

zkat reviewed Jul 30, 2018
View reviewed changes

zkat changed the base branch from latest to release-nextJuly 30, 2018 21:28

zkat approved these changes Jul 30, 2018
View reviewed changes

zkat removed the needs-discussion label Jul 30, 2018

lennym mentioned this pull request Aug 1, 2018
Add npm audit to ci pipeline UKHomeOffice/asl#91
Merged

zkat mentioned this pull request Aug 3, 2018
[feat] yarn audit yarnpkg/yarn#5808
Closed

fixing linter issue
6044aca

zkat merged commit 792c8c7 into npm:release-nextAug 3, 2018

lennym deleted the feature/configurable-audit-level branch August 20, 2018 10:49

justingreenberg mentioned this pull request Sep 5, 2018
Switching from yarn to npm react-boilerplate/react-boilerplate#2329
Merged

ngraef added a commit to ngraef/cli that referenced this pull request Feb 13, 2019
doc: add --audit-level param
c20934c
implementation added in npm#31

ngraef mentioned this pull request Feb 13, 2019
doc: add --audit-level param #159
Closed

isaacs pushed a commit that referenced this pull request Jun 26, 2019
doc: add --audit-level param
4936ba9
implementation added in #31

isaacs pushed a commit that referenced this pull request Jun 28, 2019
doc: add --audit-level param
7d9d755
implementation added in #31

isaacs pushed a commit that referenced this pull request Jun 29, 2019
doc: add --audit-level param
0cd8df1
implementation added in #31

isaacs pushed a commit that referenced this pull request Jun 30, 2019
doc: add --audit-level param
747fdaf
implementation added in #31

NOUIY mentioned this pull request Apr 22, 2022
[Snyk] Upgrade @npmcli/map-workspaces from 2.0.0 to 2.0.2 NOUIY/cli#13
Open

kevinjm39 mentioned this pull request May 1, 2022
[Snyk] Upgrade @npmcli/map-workspaces from 2.0.0 to 2.0.2 kevinjm39/cli#3
Open

This was referenced May 12, 2022
[Snyk] Upgrade @npmcli/map-workspaces from 2.0.0 to 2.0.3 NOUIY/cli#17
Open
[Snyk] Upgrade @npmcli/map-workspaces from 2.0.0 to 2.0.3 NOUIY/cli#18
Open

This was referenced May 14, 2022
[Snyk] Upgrade @npmcli/map-workspaces from 2.0.0 to 2.0.3 NOUIY/cli#20
Open
[Snyk] Upgrade @npmcli/map-workspaces from 2.0.0 to 2.0.3 NOUIY/cli#21
Open

koralle pushed a commit to koralle/npm-cli that referenced this pull request Feb 11, 2026
feat: introducesearchcommand (npm#31)
36d5dd2

github-actionsBot referenced this pull request in Kevinlee7250/cli Jul 1, 2026
🤖 봇 응답 (#31)
a763ed7

github-actionsBot referenced this pull request in Kevinlee7250/cli Jul 5, 2026
🔧 자동 수리 완료 (#31)
bb7940c

github-actionsBot referenced this pull request in Kevinlee7250/cli Jul 26, 2026
🔥 트렌드 선점 후보 갱신 (#31)
4dab2ab

github-actionsBot referenced this pull request in Kevinlee7250/cli Aug 12, 2026
🔍 구글 색인 상태 리포트 (#31)
e2f0426

github-actionsBot referenced this pull request in Kevinlee7250/cli Aug 18, 2026
📅 시리즈 발행 예약 처리 (#31)
357d89c