@mnci/cli 4.40.8 → 4.40.9

package/dist/cli.js

@@ -299,27 +299,35 @@ function planIsEmpty(stdout) {
     return false;
   }
 }
-function auditNpm(result, dryRun, log) {
+function auditNpm(result, production, dryRun, log) {
   let report;
+  let shipped;
   try {
     report = JSON.parse(result.stdout);
+    shipped = JSON.parse(production.stdout);
   } catch {
     log(`npm audit produced no JSON (exit ${result.status}) - not blocking on a broken audit.`);
     return 0;
   }
-  const { blocking, total, notes } = classifyNpmAudit(report);
+  const { notes } = classifyNpmAudit(report);
+  const { blocking, total } = classifyNpmAudit(shipped);
+  const productionNames = new Set(Object.keys(shipped.vulnerabilities ?? {}));
+  const developmentOnly = classifyNpmAudit(report).blocking.filter((advisory) => !productionNames.has(advisory.name));
   for (const note of notes) {
     log(note);
   }
+  for (const advisory of developmentOnly) {
+    log(`  note [${advisory.severity}] ${advisory.name} - reaches only dev dependencies, which no consumer receives, so it does not block`);
+  }
   if (blocking.length === 0) {
-    log(`npm audit - ${total} advisory(ies), none actionable at moderate or above.`);
+    log(`npm audit - ${Object.keys(report.vulnerabilities ?? {}).length} advisory(ies), none actionable at moderate or above in production dependencies.`);
     return 0;
   }
   if (planIsEmpty(dryRun().stdout)) {
     for (const advisory of blocking) {
       log(`  note [${advisory.severity}] ${advisory.name} - npm reports a fix, but npm audit fix has nothing to apply`);
     }
-    log(`npm audit - ${total} advisory(ies); ${blocking.length} reported as fixable, but no patched release is reachable, so there is nothing to do here.`);
+    log(`npm audit - ${total} production advisory(ies); ${blocking.length} reported as fixable, but no patched release is reachable, so there is nothing to do here.`);
     return 0;
   }
   for (const advisory of blocking) {
@@ -348,7 +356,12 @@ function runAudit(workspaceRoot, dependencies = {}) {
     }
   };
   log(groupStart(host, "npm audit"));
-  const npm = auditNpm(processes.capture("npm", ["audit", "--json"]), () => processes.capture("npm", ["audit", "fix", "--dry-run", "--json"]), log);
+  const npm = auditNpm(
+    processes.capture("npm", ["audit", "--json"]),
+    processes.capture("npm", ["audit", "--omit=dev", "--json"]),
+    () => processes.capture("npm", ["audit", "fix", "--omit=dev", "--dry-run", "--json"]),
+    log
+  );
   closeGroup();
   if (npm !== 0) {
     return npm;