pnpm audit

Verifica la presenza di problemi di sicurezza noti con i pacchetti installati.

If security issues are found, try to update your dependencies via pnpm update. If a simple update does not fix all the issues, use overrides to force versions that are not vulnerable. For instance, if lodash@<2.1.0 is vulnerable, use this overrides to force lodash@^2.1.0:

pnpm-workspace.yaml

overrides:
  "lodash@<2.1.0": "^2.1.0"

Or alternatively, run pnpm audit --fix.

If you want to tolerate some vulnerabilities as they don't affect your project, you may use the auditConfig.ignoreCves setting.

Opzioni

--audit-level <severity>

• Type: low, moderate, high, critical
• Default: low

Only print advisories with severity greater than or equal to <severity>.

This can also be set via auditLevel in pnpm-workspace.yaml.

--fix

Add overrides to the package.json file in order to force non-vulnerable versions of the dependencies.

--json

Rapporto di audit in uscita in formato JSON.

--dev, -D

Controlla solo le dipendenze di sviluppo.

--prod, -P

Controlla solo le dipendenze di produzione.

--no-optional

Don't audit optionalDependencies.

--ignore-registry-errors

Se il registro risponde con un codice di stato diverso da 200, il processo dovrebbe terminare con 0. Quindi il processo fallirà solo se il registro risponde effettivamente con successo con le vulnerabilità trovate.

--ignore-unfixable

Added in: v10.11.0

Ignore all CVEs with no resolution.

--ignore <vulnerability>

Added in: v10.11.0

Ignore a vulnerability by CVE.

Configurazione

auditConfig

auditConfig.ignoreCves

A list of CVE IDs that will be ignored by the pnpm audit command.

auditConfig:
  ignoreCves:
    - CVE-2022-36313

auditConfig.ignoreGhsas

A list of GHSA Codes that will be ignored by the pnpm audit command.

auditConfig:
  ignoreGhsas:
    - GHSA-42xw-2xvc-qx8m
    - GHSA-4w2v-q235-vp99
    - GHSA-cph5-m8f7-6c5x
    - GHSA-vh95-rmgr-6w4m