pnpm audit

설치된 패키지의 알려진 보안 문제를 확인합니다.

If security issues are found, try to update your dependencies via pnpm update. If a simple update does not fix all the issues, use overrides to force versions that are not vulnerable. For instance, if lodash@<2.1.0 is vulnerable, use this overrides to force lodash@^2.1.0:

pnpm-workspace.yaml

overrides:
  "lodash@<2.1.0": "^2.1.0"

Or alternatively, run pnpm audit --fix.

If you want to tolerate some vulnerabilities as they don't affect your project, you may use the auditConfig.ignoreCves setting.

옵션#

--audit-level <severity>#

Type: low, moderate, high, critical
Default: low

Only print advisories with severity greater than or equal to <severity>.

This can also be set via auditLevel in pnpm-workspace.yaml.

--fix#

Add overrides to the package.json file in order to force non-vulnerable versions of the dependencies.

--json#

JSON 형식으로 검사 보고서를 출력합니다.

--dev, -D#

개발 의존성만 검사합니다.

--prod, -P#

프로덕션 종속성만 검사합니다.

--no-optional#

Don't audit optionalDependencies.

--ignore-registry-errors#

레지스트리가 200이 아닌 상태 코드로 응답하면 프로세스가 0으로 종료되어야 합니다. 따라서 레지스트리가 실제로 발견된 취약점에 성공적으로 응답하는 경우에만 프로세스가 실패합니다.

--ignore-unfixable#

Added in: v10.11.0

Ignore all CVEs with no resolution.

--ignore <vulnerability>#

Added in: v10.11.0

Ignore a vulnerability by CVE.

환경설정#

auditConfig#

auditConfig.ignoreCves#

A list of CVE IDs that will be ignored by the pnpm audit command.

auditConfig:
  ignoreCves:
    - CVE-2022-36313

auditConfig.ignoreGhsas#

A list of GHSA Codes that will be ignored by the pnpm audit command.

auditConfig:
  ignoreGhsas:
    - GHSA-42xw-2xvc-qx8m
    - GHSA-4w2v-q235-vp99
    - GHSA-cph5-m8f7-6c5x
    - GHSA-vh95-rmgr-6w4m