@knime/utils 1.10.1 → 1.11.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @knime/utils
 
+## 1.11.1
+
+### Patch Changes
+
+- 7b602bf: update dompurify
+
+## 1.11.0
+
+### Minor Changes
+
+- ce7f504: Added a tool to provide audit for pnpm using the bulk advisory endpoint
+
 ## 1.10.1
 
 ### Patch Changes

package/README.md

@@ -18,6 +18,12 @@ To use it in your project, you can import it as follows:
 import { capitalize } from "@knime/utils";
 ```
 
+## Audit tool
+
+This package also ships a CLI tool (`pnpm-bulk-audit`) that audits dependencies
+using the npm bulk advisory API — a drop-in workaround while `pnpm audit` is
+broken. See [src/audit/README.md](src/audit/README.md) for details.
+
 # Join the Community!
 
 - [KNIME Forum](https://forum.knime.com/)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@knime/utils",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "description": "Internal utility functions and constants shared across @knime packages.",
   "repository": {
     "type": "git",
@@ -14,7 +14,7 @@
   "dependencies": {
     "date-fns": "2.30.0",
     "date-fns-tz": "2.0.0",
-    "dompurify": "^3.3.2",
+    "dompurify": "^3.4.7",
     "filesize": "10.0.6"
   },
   "peerDependencies": {
@@ -34,10 +34,16 @@
     "CHANGELOG.md"
   ],
   "sideEffects": false,
+  "bin": {
+    "pnpm-bulk-audit": "./src/audit/cli.js"
+  },
   "exports": {
     ".": {
       "import": "./src/index.ts"
     },
+    "./audit": {
+      "import": "./src/audit/bulkAudit.js"
+    },
     "./globals.d.ts": {
       "import": "./src/config/globals.d.ts"
     },

package/src/audit/README.md

@@ -0,0 +1,118 @@
+# pnpm Bulk Audit
+
+A workaround for `pnpm audit` failing with HTTP 410 after npm retired the legacy
+audit endpoints. This tool calls the replacement
+[bulk advisory endpoint](https://api-docs.npmjs.com/#tag/Audit) directly.
+
+**Background:** In April 2026 npm retired `/-/npm/v1/security/audits` (and the
+`/quick` variant). `pnpm audit` on all 10.x and early 11.x versions is broken
+because it still calls the old endpoints. See
+[pnpm/pnpm#11265](https://github.com/pnpm/pnpm/issues/11265). This tool bridges
+the gap until pnpm ships a fix.
+
+## Quick start
+
+Add `@knime/utils` as a dev dependency (it is already present in the monorepo),
+then call the binary directly:
+
+```jsonc
+// package.json
+{
+  "scripts": {
+    "audit": "pnpm-bulk-audit",
+  },
+  "devDependencies": {
+    "@knime/utils": "workspace:*",
+  },
+}
+```
+
+Then run:
+
+```bash
+pnpm run audit
+```
+
+## CLI options
+
+```
+Usage: pnpm-bulk-audit [options]
+
+Options:
+  --lockfile <path>     Path to pnpm-lock.yaml (default: ./pnpm-lock.yaml)
+  --registry <url>      npm registry URL (default: https://registry.npmjs.org)
+  --severity <level>    Minimum severity: low, moderate, high, critical (default: low)
+  --prod, -P            Only report vulnerabilities in production dependencies
+  --json                Output raw JSON
+  --no-ignore           Skip reading ignoreCves/ignoreGhsas from config
+  --help, -h            Show this help
+```
+
+## Prod vs dev classification
+
+Each vulnerability is annotated with `[prod]` or `[dev]` based on whether the
+affected package is reachable from any importer's `dependencies` (as opposed to
+`devDependencies`). The classifier walks the full dependency graph in the
+lockfile, following workspace links transitively.
+
+Use `--prod` (or `-P`) to only report vulnerabilities in production
+dependencies.
+
+## Ignore lists
+
+The tool reads `auditConfig.ignoreCves` and `auditConfig.ignoreGhsas` from two
+places (both are merged):
+
+### pnpm-workspace.yaml
+
+```yaml
+auditConfig:
+  ignoreCves:
+    - CVE-2026-4800
+  ignoreGhsas:
+    - GHSA-78h3-pg4x-j8cv
+```
+
+### package.json
+
+```jsonc
+{
+  "pnpm": {
+    "auditConfig": {
+      "ignoreCves": ["CVE-2026-4800"],
+      "ignoreGhsas": ["GHSA-78h3-pg4x-j8cv"],
+    },
+  },
+}
+```
+
+**GHSA IDs** are matched directly from the advisory URL returned by the npm
+registry.
+**CVE IDs** require an extra lookup via the GitHub advisories API
+(`api.github.com/advisories/{ghsa}`) because the npm bulk endpoint does not
+include CVE identifiers in its response.
+
+Use `--no-ignore` to skip all ignore-list processing.
+
+## Programmatic usage
+
+```ts
+import { audit, formatAuditReport, readAuditConfig } from "@knime/utils/audit";
+
+const config = readAuditConfig(".");
+const result = await audit({
+  lockfilePath: "./pnpm-lock.yaml",
+  minSeverity: "high",
+  auditConfig: config,
+});
+console.log(formatAuditReport(result));
+```
+
+## How it works
+
+1. Parses the `packages:` section of `pnpm-lock.yaml` to extract every
+   `name@version` pair.
+2. POSTs them as `{ "pkg": ["version", …] }` to the npm bulk advisory endpoint
+   (`/-/npm/v1/security/advisories/bulk`).
+3. Filters the response by severity and ignore lists.
+4. Exits with code 1 if any vulnerabilities remain, 0 otherwise.

package/src/audit/bulkAudit.js

@@ -0,0 +1,671 @@
+/* eslint-disable no-console, n/no-process-env */
+/**
+ * Audits packages from a pnpm-lock.yaml file using the npm bulk advisory API.
+ *
+ * The legacy npm audit endpoints (/-/npm/v1/security/audits) have been retired
+ * (HTTP 410). This module calls the replacement bulk advisory endpoint
+ * (/-/npm/v1/security/advisories/bulk) directly.
+ *
+ * See: https://api-docs.npmjs.com/#tag/Audit
+ * See: https://github.com/pnpm/pnpm/issues/11265
+ */
+
+import { execSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+
+const SEVERITY_ORDER = ["low", "moderate", "high", "critical"];
+
+/**
+ * Resolve a GitHub API token from GITHUB_TOKEN env var or `gh auth token`.
+ * Returns null (with a warning) if neither is available.
+ */
+function getGitHubToken() {
+  if (process.env.GITHUB_TOKEN) {
+    return process.env.GITHUB_TOKEN;
+  }
+  try {
+    return execSync("gh auth token", { encoding: "utf-8" }).trim();
+  } catch {
+    // gh CLI not installed or not authenticated
+  }
+  console.warn(
+    "Warning: No GitHub token found (GITHUB_TOKEN env or `gh auth token`).\n" +
+      "GHSA→CVE resolution will use unauthenticated requests (60 req/hour limit).\n",
+  );
+  return null;
+}
+
+/**
+ * Extract the GHSA ID from an advisory URL like
+ * `https://github.com/advisories/GHSA-r5fr-rjxr-66jc`.
+ */
+function extractGhsaId(url) {
+  const match = url.match(/(GHSA-[a-z0-9]{4}-[a-z0-9]{4}-[a-z0-9]{4})/i);
+  return match ? match[1] : null;
+}
+
+/**
+ * Minimally parse a YAML value that is a string array. Handles lines like:
+ *   - CVE-2026-4800
+ *   - CVE-2026-2950 # comment
+ */
+function parseYamlStringArray(lines, startIdx, indent) {
+  const result = [];
+  for (let i = startIdx; i < lines.length; i++) {
+    const line = lines[i];
+    // Skip blank lines and comment-only lines at the expected indentation
+    if (/^\s*$/.test(line) || new RegExp(`^ {${indent}}#`).test(line)) {
+      continue;
+    }
+    // Check if this line is an array item at the expected indentation
+    const itemMatch = line.match(new RegExp(`^ {${indent}}-\\s+(.+)`));
+    if (!itemMatch) {
+      break;
+    }
+    // Strip inline comments
+    const value = itemMatch[1].replace(/#.*$/, "").trim();
+    if (value) {
+      result.push(value);
+    }
+  }
+  return result;
+}
+
+/**
+ * Read auditConfig from pnpm-workspace.yaml (top-level `auditConfig` key).
+ */
+function readAuditConfigFromWorkspace(workspaceDir) {
+  const config = {};
+  const wsPath = resolve(workspaceDir, "pnpm-workspace.yaml");
+  if (!existsSync(wsPath)) {
+    return config;
+  }
+
+  const content = readFileSync(wsPath, "utf-8");
+  const lines = content.split("\n");
+
+  let inAuditConfig = false;
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+
+    if (/^auditConfig:\s*$/.test(line)) {
+      inAuditConfig = true;
+      continue;
+    }
+    // New top-level key ends auditConfig
+    if (inAuditConfig && /^\S/.test(line)) {
+      break;
+    }
+    if (!inAuditConfig) {
+      continue;
+    }
+
+    if (/^ {2}ignoreCves:\s*$/.test(line)) {
+      // eslint-disable-next-line no-magic-numbers
+      config.ignoreCves = parseYamlStringArray(lines, i + 1, 4);
+    }
+    if (/^ {2}ignoreGhsas:\s*$/.test(line)) {
+      // eslint-disable-next-line no-magic-numbers
+      config.ignoreGhsas = parseYamlStringArray(lines, i + 1, 4);
+    }
+  }
+
+  return config;
+}
+
+/**
+ * Read auditConfig from package.json (`pnpm.auditConfig` key).
+ */
+function readAuditConfigFromPackageJson(workspaceDir) {
+  const config = {};
+  const pkgPath = resolve(workspaceDir, "package.json");
+  if (!existsSync(pkgPath)) {
+    return config;
+  }
+
+  try {
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
+    const auditConfig = pkg?.pnpm?.auditConfig;
+    if (auditConfig) {
+      if (Array.isArray(auditConfig.ignoreCves)) {
+        config.ignoreCves = auditConfig.ignoreCves;
+      }
+      if (Array.isArray(auditConfig.ignoreGhsas)) {
+        config.ignoreGhsas = auditConfig.ignoreGhsas;
+      }
+    }
+  } catch {
+    // ignore parse errors
+  }
+
+  return config;
+}
+
+/**
+ * Merge auditConfig from pnpm-workspace.yaml and package.json.
+ * Both sources are combined (union of ignore lists).
+ */
+export function readAuditConfig(workspaceDir) {
+  const fromWorkspace = readAuditConfigFromWorkspace(workspaceDir);
+  const fromPkg = readAuditConfigFromPackageJson(workspaceDir);
+
+  return {
+    ignoreCves: [
+      ...(fromWorkspace.ignoreCves ?? []),
+      ...(fromPkg.ignoreCves ?? []),
+    ],
+    ignoreGhsas: [
+      ...(fromWorkspace.ignoreGhsas ?? []),
+      ...(fromPkg.ignoreGhsas ?? []),
+    ],
+  };
+}
+
+/**
+ * Resolve GHSA IDs to their associated CVE IDs using the GitHub advisories API.
+ * Returns a map from GHSA ID to an array of CVE IDs.
+ */
+async function resolveGhsaToCves(ghsaIds) {
+  const map = new Map();
+  if (ghsaIds.length === 0) {
+    return map;
+  }
+
+  const token = getGitHubToken();
+  const headers = { Accept: "application/vnd.github+json" };
+  if (token) {
+    headers.Authorization = `Bearer ${token}`;
+  }
+
+  // Fetch in parallel, but limit concurrency to avoid rate limits
+  const batchSize = 10;
+  for (let i = 0; i < ghsaIds.length; i += batchSize) {
+    const batch = ghsaIds.slice(i, i + batchSize);
+    const results = await Promise.all(
+      batch.map(async (ghsaId) => {
+        try {
+          const resp = await fetch(
+            `https://api.github.com/advisories/${ghsaId}`,
+            { headers },
+          );
+          if (!resp.ok) {
+            console.warn(
+              `Warning: GitHub advisory lookup for ${ghsaId} failed (HTTP ${resp.status}). CVE ignore rules may not apply.`,
+            );
+            return { ghsaId, cves: [] };
+          }
+          const data = await resp.json();
+          const cves = (data.identifiers ?? [])
+            .filter((id) => id.type === "CVE")
+            .map((id) => id.value);
+          return { ghsaId, cves };
+        } catch (err) {
+          console.warn(
+            `Warning: GitHub advisory lookup for ${ghsaId} failed: ${err instanceof Error ? err.message : String(err)}. CVE ignore rules may not apply.`,
+          );
+          return { ghsaId, cves: [] };
+        }
+      }),
+    );
+    for (const { ghsaId, cves } of results) {
+      map.set(ghsaId, cves);
+    }
+  }
+
+  return map;
+}
+
+/**
+ * Parse a snapshot key like `lodash-es@4.17.23` or
+ * `vite@7.3.1(@types/node@24.10.1)(terser@5.44.1)` and return the
+ * base `name@version` (without peer suffixes).
+ */
+function snapshotKeyToNameVersion(key) {
+  // Find the version segment: last `@` before any `(`
+  const parenIdx = key.indexOf("(");
+  const base = parenIdx >= 0 ? key.slice(0, parenIdx) : key;
+  return base;
+}
+
+/**
+ * Classify every package in the lockfile as "prod" or "dev" by walking the
+ * dependency graph starting from each importer's `dependencies`.
+ *
+ * Returns a Set of `name@version` strings that are reachable from production
+ * dependency roots. Any package NOT in this set is dev-only.
+ */
+// eslint-disable-next-line complexity
+export function classifyProdPackages(lockfilePath) {
+  const content = readFileSync(lockfilePath, "utf-8");
+  const lines = content.split("\n");
+
+  // --- Phase 1: parse all importers into structured data ---
+  const importers = new Map();
+
+  {
+    let section = "none";
+    let currentImporter = null;
+    let currentDepName = null;
+    let inDeps = false;
+
+    for (const line of lines) {
+      if (/^importers:\s*$/.test(line)) {
+        section = "importers";
+        continue;
+      }
+      if (/^(packages|snapshots|catalogs|settings):\s*$/.test(line)) {
+        if (section === "importers") {
+          break;
+        }
+        continue;
+      }
+      if (section !== "importers") {
+        continue;
+      }
+
+      // Importer key (2-space indent)
+      if (
+        /^ {2}\S/.test(line) &&
+        !line.match(
+          /^ {2}(dependencies|devDependencies|peerDependencies|optionalDependencies):/,
+        )
+      ) {
+        currentImporter = line.replace(/^ {2}/, "").replace(/:.*$/, "");
+        importers.set(currentImporter, { prodVersions: [], prodLinks: [] });
+        inDeps = false;
+        continue;
+      }
+
+      if (!currentImporter) {
+        continue;
+      }
+
+      // Sub-section detection
+      if (/^ {4}dependencies:\s*$/.test(line)) {
+        inDeps = true;
+        currentDepName = null;
+        continue;
+      }
+      if (
+        /^ {4}(devDependencies|peerDependencies|optionalDependencies):\s*$/.test(
+          line,
+        )
+      ) {
+        inDeps = false;
+        currentDepName = null;
+        continue;
+      }
+
+      if (inDeps) {
+        const versionMatch = line.match(/^ {8}version:\s+'?(.+?)'?\s*$/);
+        if (versionMatch) {
+          const ver = versionMatch[1];
+          const data = importers.get(currentImporter);
+          if (ver.startsWith("link:")) {
+            // eslint-disable-next-line no-magic-numbers
+            data.prodLinks.push(ver.slice(5)); // strip "link:" prefix
+          } else if (currentDepName) {
+            data.prodVersions.push(`${currentDepName}@${ver}`);
+          }
+        }
+        // Package name key: `      package-name:`
+        const nameMatch = line.match(/^ {6}'?([^':]+)'?:\s*$/);
+        if (nameMatch) {
+          currentDepName = nameMatch[1];
+        }
+      }
+    }
+  }
+
+  // Resolve workspace links to importer IDs.
+  function resolveLink(fromImporter, linkTarget) {
+    if (fromImporter === ".") {
+      return linkTarget.replace(/^\.\//, "");
+    }
+    const parts = fromImporter.split("/");
+    for (const seg of linkTarget.split("/")) {
+      if (seg === "..") {
+        parts.pop();
+      } else if (seg !== ".") {
+        parts.push(seg);
+      }
+    }
+    return parts.join("/");
+  }
+
+  // Collect all prod roots
+  const prodRoots = new Set();
+  const visitedImporters = new Set();
+
+  function collectProdFromImporter(importerId) {
+    if (visitedImporters.has(importerId)) {
+      return;
+    }
+    visitedImporters.add(importerId);
+    const data = importers.get(importerId);
+    if (!data) {
+      return;
+    }
+
+    for (const ver of data.prodVersions) {
+      prodRoots.add(ver);
+    }
+    for (const linkTarget of data.prodLinks) {
+      const linkedImporter = resolveLink(importerId, linkTarget);
+      collectProdFromImporter(linkedImporter);
+    }
+  }
+
+  for (const importerId of importers.keys()) {
+    collectProdFromImporter(importerId);
+  }
+
+  // --- Phase 2: parse snapshots to build adjacency map ---
+  const snapshotDeps = new Map();
+  let inSnapshots = false;
+  let currentSnapshot = null;
+  let inSnapshotDeps = false;
+
+  for (const line of lines) {
+    if (/^snapshots:\s*$/.test(line)) {
+      inSnapshots = true;
+      continue;
+    }
+    if (inSnapshots && /^\S/.test(line) && !line.startsWith("snapshots:")) {
+      break;
+    }
+    if (!inSnapshots) {
+      continue;
+    }
+
+    const snapMatch = line.match(/^ {2}'?([^'\s].*?)'?:\s*(\{\})?$/);
+    if (snapMatch && !line.startsWith("    ")) {
+      currentSnapshot = snapMatch[1];
+      if (!snapshotDeps.has(currentSnapshot)) {
+        snapshotDeps.set(currentSnapshot, []);
+      }
+      inSnapshotDeps = false;
+      if (snapMatch[2]) {
+        currentSnapshot = null;
+      }
+      continue;
+    }
+
+    if (!currentSnapshot) {
+      continue;
+    }
+
+    if (/^ {4}(dependencies|optionalDependencies):\s*$/.test(line)) {
+      inSnapshotDeps = true;
+      continue;
+    }
+    if (
+      /^ {4}\S/.test(line) &&
+      !line.match(/^ {4}(dependencies|optionalDependencies):/)
+    ) {
+      inSnapshotDeps = false;
+      continue;
+    }
+
+    if (inSnapshotDeps) {
+      const depMatch = line.match(/^ {6}'?([^':]+)'?:\s+'?(.+?)'?\s*$/);
+      if (depMatch) {
+        const depName = depMatch[1];
+        const depVersion = depMatch[2];
+        snapshotDeps.get(currentSnapshot).push(`${depName}@${depVersion}`);
+      }
+    }
+  }
+
+  // --- Phase 3: BFS from prod roots ---
+  const prodPackages = new Set();
+  const visited = new Set();
+  const queue = [...prodRoots];
+
+  while (queue.length > 0) {
+    const key = queue.pop();
+    if (visited.has(key)) {
+      continue;
+    }
+    visited.add(key);
+
+    const baseKey = snapshotKeyToNameVersion(key);
+    prodPackages.add(baseKey);
+
+    const deps = snapshotDeps.get(key);
+    if (deps) {
+      queue.push(...deps);
+    } else {
+      for (const [snapKey, snapDeps] of snapshotDeps) {
+        if (
+          snapshotKeyToNameVersion(snapKey) === baseKey &&
+          !visited.has(snapKey)
+        ) {
+          visited.add(snapKey);
+          queue.push(...snapDeps);
+        }
+      }
+    }
+  }
+
+  return prodPackages;
+}
+
+/**
+ * Minimally parse pnpm-lock.yaml to extract the `packages:` keys.
+ */
+export function extractPackagesFromLockfile(lockfilePath) {
+  const content = readFileSync(lockfilePath, "utf-8");
+  const lines = content.split("\n");
+
+  const packages = new Map();
+  let inPackagesSection = false;
+
+  for (const line of lines) {
+    if (/^packages:\s*$/.test(line)) {
+      inPackagesSection = true;
+      continue;
+    }
+
+    if (
+      inPackagesSection &&
+      /^\S/.test(line) &&
+      !line.startsWith("packages:")
+    ) {
+      break;
+    }
+
+    if (!inPackagesSection) {
+      continue;
+    }
+
+    const match = line.match(/^ {2}'?([^':\s][^':]*?)@(\d[^':]*)'?:\s*$/);
+    if (!match) {
+      const unquotedMatch = line.match(
+        /^ {2}([^':\s][^':]*?)@(\d[^':]*?):\s*$/,
+      );
+      if (unquotedMatch) {
+        const name = unquotedMatch[1];
+        const version = unquotedMatch[2].replace(/\(.*$/, "");
+        if (name && version) {
+          // eslint-disable-next-line max-depth
+          if (!packages.has(name)) {
+            packages.set(name, new Set());
+          }
+          packages.get(name).add(version);
+        }
+      }
+      continue;
+    }
+
+    const name = match[1];
+    const version = match[2].replace(/\(.*$/, ""); // strip peer suffixes
+    if (name && version) {
+      if (!packages.has(name)) {
+        packages.set(name, new Set());
+      }
+      packages.get(name).add(version);
+    }
+  }
+
+  return packages;
+}
+
+/**
+ * Call the npm bulk advisory endpoint and return the report.
+ */
+export async function fetchBulkAdvisories(
+  packages,
+  registry = "https://registry.npmjs.org",
+) {
+  const body = {};
+  for (const [name, versions] of packages) {
+    body[name] = [...versions];
+  }
+
+  const url = `${registry.replace(/\/$/, "")}/-/npm/v1/security/advisories/bulk`;
+
+  const response = await fetch(url, {
+    method: "POST",
+    headers: { "Content-Type": "application/json" },
+    body: JSON.stringify(body),
+  });
+
+  if (!response.ok) {
+    throw new Error(
+      `Bulk advisory endpoint responded with ${response.status}: ${await response.text()}`,
+    );
+  }
+
+  return response.json();
+}
+
+/**
+ * Run a full audit: parse lockfile, query the API, return structured results.
+ * Respects ignore lists from pnpm-workspace.yaml and package.json.
+ */
+export async function audit(opts) {
+  const lockfilePath = resolve(opts.lockfilePath);
+  const packages = extractPackagesFromLockfile(lockfilePath);
+  const advisories = await fetchBulkAdvisories(packages, opts.registry);
+
+  // Classify prod vs dev
+  const prodPackages = classifyProdPackages(lockfilePath);
+
+  // Collect ignore sets
+  const ignoredGhsas = new Set(opts.auditConfig?.ignoreGhsas ?? []);
+  const ignoredCves = new Set(opts.auditConfig?.ignoreCves ?? []);
+  const needCveResolution = ignoredCves.size > 0;
+
+  // If we have CVEs to ignore, resolve GHSA→CVE mappings
+  let ghsaToCves = new Map();
+  if (needCveResolution) {
+    const allGhsaIds = new Set();
+    for (const advList of Object.values(advisories)) {
+      for (const a of advList) {
+        const ghsaId = extractGhsaId(a.url);
+        if (ghsaId) {
+          allGhsaIds.add(ghsaId);
+        }
+      }
+    }
+    ghsaToCves = await resolveGhsaToCves([...allGhsaIds]);
+  }
+
+  const minIdx = SEVERITY_ORDER.indexOf(opts.minSeverity ?? "low");
+  const severityCounts = {};
+  let totalVulnerabilities = 0;
+  let prodVulnerabilities = 0;
+  let devVulnerabilities = 0;
+  const filteredAdvisories = {};
+
+  for (const [pkg, advList] of Object.entries(advisories)) {
+    const versions = packages.get(pkg);
+    const isProd = versions
+      ? [...versions].some((v) => prodPackages.has(`${pkg}@${v}`))
+      : false;
+    const depType = isProd ? "prod" : "dev";
+
+    if (opts.prod && !isProd) {
+      continue;
+    }
+
+    const filtered = advList.filter((a) => {
+      const idx = SEVERITY_ORDER.indexOf(a.severity);
+      if (idx < minIdx) {
+        return false;
+      }
+
+      const ghsaId = extractGhsaId(a.url);
+      if (ghsaId && ignoredGhsas.has(ghsaId)) {
+        return false;
+      }
+
+      if (ghsaId && needCveResolution) {
+        const cves = ghsaToCves.get(ghsaId) ?? [];
+        if (cves.some((cve) => ignoredCves.has(cve))) {
+          return false;
+        }
+      }
+
+      return true;
+    });
+    if (filtered.length > 0) {
+      filteredAdvisories[pkg] = filtered.map((a) => ({ ...a, depType }));
+      for (const a of filtered) {
+        severityCounts[a.severity] = (severityCounts[a.severity] ?? 0) + 1;
+        totalVulnerabilities++;
+        if (isProd) {
+          prodVulnerabilities++;
+        } else {
+          devVulnerabilities++;
+        }
+      }
+    }
+  }
+
+  return {
+    advisories: filteredAdvisories,
+    totalVulnerabilities,
+    severityCounts,
+    prodVulnerabilities,
+    devVulnerabilities,
+  };
+}
+
+/**
+ * Format an audit result for human-readable console output.
+ */
+export function formatAuditReport(result) {
+  if (result.totalVulnerabilities === 0) {
+    return "No vulnerabilities found.";
+  }
+
+  const lines = [];
+  lines.push(
+    `Found ${result.totalVulnerabilities} vulnerabilit${result.totalVulnerabilities === 1 ? "y" : "ies"} (${result.prodVulnerabilities} prod, ${result.devVulnerabilities} dev):\n`,
+  );
+
+  for (const severity of SEVERITY_ORDER) {
+    const count = result.severityCounts[severity];
+    if (count) {
+      lines.push(`  ${severity}: ${count}`);
+    }
+  }
+  lines.push("");
+
+  for (const [pkg, advList] of Object.entries(result.advisories)) {
+    for (const adv of advList) {
+      const tag = adv.depType === "prod" ? "prod" : "dev";
+      // eslint-disable-next-line no-magic-numbers
+      lines.push(`  ${adv.severity.toUpperCase().padEnd(9)} ${pkg} [${tag}]`);
+      lines.push(`    ${adv.title}`);
+      lines.push(`    Vulnerable: ${adv.vulnerable_versions}`);
+      lines.push(`    ${adv.url}`);
+      lines.push("");
+    }
+  }
+
+  return lines.join("\n");
+}

package/src/audit/cli.js

@@ -0,0 +1,117 @@
+#!/usr/bin/env node
+/* eslint-disable no-console, n/no-process-exit */
+
+/**
+ * CLI wrapper for the bulk advisory audit.
+ *
+ * Usage:
+ *   pnpm-bulk-audit [--lockfile path] [--registry url] [--severity level] [--json]
+ *
+ * Defaults:
+ *   --lockfile  pnpm-lock.yaml (in cwd)
+ *   --registry  https://registry.npmjs.org
+ *   --severity  low
+ */
+
+import { existsSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+
+import { audit, formatAuditReport, readAuditConfig } from "./bulkAudit.js";
+
+function parseArgs(args) {
+  let lockfilePath = resolve("pnpm-lock.yaml");
+  let registry = "https://registry.npmjs.org";
+  let minSeverity = "low";
+  let json = false;
+  let noIgnore = false;
+  let prod = false;
+
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i];
+    if (arg === "--lockfile" && args[i + 1]) {
+      lockfilePath = resolve(args[++i]);
+    } else if (arg === "--registry" && args[i + 1]) {
+      registry = args[++i];
+    } else if (arg === "--severity" && args[i + 1]) {
+      minSeverity = args[++i];
+      const validSeverities = ["low", "moderate", "high", "critical"];
+      if (!validSeverities.includes(minSeverity)) {
+        console.error(
+          `Error: unknown severity "${minSeverity}". Must be one of: ${validSeverities.join(", ")}`,
+        );
+        process.exit(1);
+      }
+    } else if (arg === "--json") {
+      json = true;
+    } else if (arg === "--no-ignore") {
+      noIgnore = true;
+    } else if (arg === "--prod" || arg === "-P") {
+      prod = true;
+    } else if (arg === "--help" || arg === "-h") {
+      console.log(`Usage: pnpm-bulk-audit [options]
+
+Options:
+  --lockfile <path>     Path to pnpm-lock.yaml (default: ./pnpm-lock.yaml)
+  --registry <url>      npm registry URL (default: https://registry.npmjs.org)
+  --severity <level>    Minimum severity: low, moderate, high, critical (default: low)
+  --prod, -P            Only report vulnerabilities in production dependencies
+  --json                Output raw JSON
+  --no-ignore           Skip reading ignoreCves/ignoreGhsas from config
+  --help, -h            Show this help`);
+      process.exit(0);
+    }
+  }
+
+  return { lockfilePath, registry, minSeverity, json, noIgnore, prod };
+}
+
+async function main() {
+  const opts = parseArgs(process.argv.slice(2));
+
+  if (!existsSync(opts.lockfilePath)) {
+    console.error(`Error: lockfile not found at ${opts.lockfilePath}`);
+    process.exit(1);
+  }
+
+  try {
+    const workspaceDir = dirname(opts.lockfilePath);
+    const auditConfig = opts.noIgnore
+      ? undefined
+      : readAuditConfig(workspaceDir);
+
+    if (auditConfig && !opts.json) {
+      const ignoredCount =
+        (auditConfig.ignoreCves?.length ?? 0) +
+        (auditConfig.ignoreGhsas?.length ?? 0);
+      if (ignoredCount > 0) {
+        console.log(
+          `Ignoring ${ignoredCount} CVE/GHSA entr${ignoredCount === 1 ? "y" : "ies"} from config.\n`,
+        );
+      }
+    }
+
+    const result = await audit({
+      lockfilePath: opts.lockfilePath,
+      registry: opts.registry,
+      minSeverity: opts.minSeverity,
+      auditConfig,
+      prod: opts.prod,
+    });
+
+    if (opts.json) {
+      console.log(JSON.stringify(result, null, 2));
+    } else {
+      console.log(formatAuditReport(result));
+    }
+
+    process.exit(result.totalVulnerabilities > 0 ? 1 : 0);
+  } catch (error) {
+    console.error(
+      `Audit failed: ${error instanceof Error ? error.message : String(error)}`,
+    );
+    process.exit(1);
+  }
+}
+
+// eslint-disable-next-line no-void
+void main();