@mnci/cli 4.40.1 → 4.40.2

package/dist/cli.js

@@ -283,7 +283,17 @@ function classifyNpmAudit(report) {
   });
   return { blocking, total: all.length, notes };
 }
-function auditNpm(result, log) {
+function planIsEmpty(stdout) {
+  try {
+    const start = stdout.search(/^\{/m);
+    const plan = JSON.parse(start === -1 ? stdout : stdout.slice(start));
+    const lists = [plan.add, plan.change, plan.remove];
+    return lists.every((list) => Array.isArray(list) && list.length === 0);
+  } catch {
+    return false;
+  }
+}
+function auditNpm(result, dryRun, log) {
   let report;
   try {
     report = JSON.parse(result.stdout);
@@ -299,6 +309,13 @@ function auditNpm(result, log) {
     log(`npm audit - ${total} advisory(ies), none actionable at moderate or above.`);
     return 0;
   }
+  if (planIsEmpty(dryRun().stdout)) {
+    for (const advisory of blocking) {
+      log(`  note [${advisory.severity}] ${advisory.name} - npm reports a fix, but npm audit fix has nothing to apply`);
+    }
+    log(`npm audit - ${total} advisory(ies); ${blocking.length} reported as fixable, but no patched release is reachable, so there is nothing to do here.`);
+    return 0;
+  }
   for (const advisory of blocking) {
     log(`  BLOCKING [${advisory.severity}] ${advisory.name} - fix available`);
   }
@@ -325,7 +342,7 @@ function runAudit(workspaceRoot, dependencies = {}) {
     }
   };
   log(groupStart(host, "npm audit"));
-  const npm = auditNpm(processes.capture("npm", ["audit", "--json"]), log);
+  const npm = auditNpm(processes.capture("npm", ["audit", "--json"]), () => processes.capture("npm", ["audit", "fix", "--dry-run", "--json"]), log);
   closeGroup();
   if (npm !== 0) {
     return npm;