Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[BUG] npm audit doesn't show github Dependabot alerts #4681

Closed
2 tasks done
Ockejanssen opened this issue Apr 5, 2022 · 3 comments · Fixed by #4735 or #4733
Closed
2 tasks done

[BUG] npm audit doesn't show github Dependabot alerts #4681

Ockejanssen opened this issue Apr 5, 2022 · 3 comments · Fixed by #4735 or #4733
Labels
Bug thing that needs fixing Priority 2 secondary priority issue Release 8.x work is associated with a specific npm 8 release

Comments

@Ockejanssen
Copy link

Is there an existing issue for this?

  • I have searched the existing issues

This issue exists in the latest npm version

  • I am using the latest npm

Current Behavior

package.json
with
"dependencies": {
"node-forge": "^0.10.0"
}

npm audit

npm audit report

node-forge <=1.2.1
Severity: moderate

Expected Behavior

CVE-2022-0122 (moderate)
CVE-2022-24773 (moderate)
CVE-2022-24772 (high)
CVE-2022-24771 (high)

The issue appears in npm 7 and npm 8. npm 6 works as expected.

Steps To Reproduce

  1. In this environment...
    npm 8
  2. With this config...
  3. Run '...'
    npm i node-forge@^0.10.0
    npm shrinkwrap
    npm audit
  4. See error...
    Only 1 moderate

Environment

  • npm: 8.6.0
  • Node.js: 16.14.2
  • OS Name: Linux, Mac
  • System Model Name:
  • npm config:
; copy and paste output from `npm config ls` here
@Ockejanssen Ockejanssen added Bug thing that needs fixing Needs Triage needs review for next steps Release 8.x work is associated with a specific npm 8 release labels Apr 5, 2022
@lukekarrys lukekarrys mentioned this issue Apr 12, 2022
Merged
lukekarrys added a commit that referenced this issue Apr 12, 2022
@lukekarrys
fix(arborist): dont skip adding advisories to audit based on name/range
c81cc0b 
When generating an audit report, a cache of seen advisories is kept to
avoid doing any repeat fanout work on its nodes. Previously this cache
was also preventing audits from being added to the report. This has been
fixed so the cache is only used to prevent extra work, but all valid
advisories are added to the output.

Fixes #4681
@lukekarrys
Copy link
Contributor

Thanks for the report! I've tracked this down and figured out we were erroneously filtering out some advisories. This should be fixed in this week's release.

@lukekarrys lukekarrys added Priority 2 secondary priority issue and removed Needs Triage needs review for next steps labels Apr 12, 2022
fritzy pushed a commit that referenced this issue Apr 13, 2022
@lukekarrys @fritzy
fix(arborist): dont skip adding advisories to audit based on name/range
aa4a4da 
When generating an audit report, a cache of seen advisories is kept to
avoid doing any repeat fanout work on its nodes. Previously this cache
was also preventing audits from being added to the report. This has been
fixed so the cache is only used to prevent extra work, but all valid
advisories are added to the output.

Fixes #4681
@github-actions github-actions bot mentioned this issue Apr 13, 2022
Merged
@Ockejanssen
Copy link
Author

Is it possible that this fix will also be part of npm version 7

@ljharb
Copy link
Contributor

ljharb commented Apr 28, 2022

v7 is EOL, so i doubt it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug thing that needs fixing Priority 2 secondary priority issue Release 8.x work is associated with a specific npm 8 release
Projects
None yet
Milestone
No milestone
3 participants
@ljharb @lukekarrys @Ockejanssen