@pnpm/deps.compliance.commands 1000.0.0 → 1100.0.0

package/lib/audit/audit.d.ts

@@ -1,4 +1,4 @@
-import { type Config, type UniversalOptions } from '@pnpm/config.reader';
+import { type Config, type ConfigContext, type UniversalOptions } from '@pnpm/config.reader';
 import { type AuditReport } from '@pnpm/deps.compliance.audit';
 import { type InstallCommandOptions } from '@pnpm/installing.commands';
 import type { Registries } from '@pnpm/types';
@@ -7,6 +7,7 @@ export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare function cliOptionsTypes(): Record<string, unknown>;
 export declare const shorthands: Record<string, string>;
 export declare const commandNames: string[];
+export declare const recursiveByDefault = true;
 export declare function help(): string;
 export type AuditOptions = Pick<UniversalOptions, 'dir'> & {
     fix?: boolean | 'override' | 'update';
@@ -16,7 +17,7 @@ export type AuditOptions = Pick<UniversalOptions, 'dir'> & {
     registries: Registries;
     ignore?: string[];
     ignoreUnfixable?: boolean;
-} & Pick<Config, 'auditConfig' | 'auditLevel' | 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'maxSockets' | 'noProxy' | 'strictSsl' | 'fetchRetries' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchRetryFactor' | 'fetchTimeout' | 'production' | 'dev' | 'overrides' | 'optional' | 'userConfig' | 'rawConfig' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'virtualStoreDirMaxLength' | 'workspaceDir'> & InstallCommandOptions;
+} & Pick<Config, 'auditConfig' | 'auditLevel' | 'minimumReleaseAge' | 'ca' | 'cert' | 'httpProxy' | 'httpsProxy' | 'key' | 'localAddress' | 'maxSockets' | 'noProxy' | 'strictSsl' | 'fetchRetries' | 'fetchRetryMaxtimeout' | 'fetchRetryMintimeout' | 'fetchRetryFactor' | 'fetchTimeout' | 'production' | 'dev' | 'overrides' | 'optional' | 'configByUri' | 'virtualStoreDirMaxLength' | 'workspaceDir'> & Pick<ConfigContext, 'rootProjectManifest' | 'rootProjectManifestDir'> & InstallCommandOptions;
 export declare function handler(opts: AuditOptions): Promise<{
     exitCode: number;
     output: string;

package/lib/audit/audit.js

@@ -69,6 +69,7 @@ export const shorthands = {
     P: '--production',
 };
 export const commandNames = ['audit'];
+export const recursiveByDefault = true;
 export function help() {
     return renderHelp({
         description: 'Checks for known security issues with the installed packages.',
@@ -135,10 +136,10 @@ export async function handler(opts) {
         optionalDependencies: opts.optional !== false,
     };
     let auditReport;
-    const getAuthHeader = createGetAuthHeaderByURI({ allSettings: opts.rawConfig, userSettings: opts.userConfig });
+    const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri, opts.registries?.default);
     try {
         auditReport = await audit(lockfile, getAuthHeader, {
-            agentOptions: {
+            dispatcherOptions: {
                 ca: opts.ca,
                 cert: opts.cert,
                 httpProxy: opts.httpProxy,
@@ -188,26 +189,34 @@ export async function handler(opts) {
     }
     if (fixMethod === 'update') {
         const result = await fixWithUpdate(auditReport, { ...opts, include });
+        let output = formatFixWithUpdateOutput(result, auditReport);
+        if (result.addedAgeExcludes.length > 0) {
+            output += `\n${result.addedAgeExcludes.length} entries were added to minimumReleaseAgeExclude to allow installing the patched versions:\n${result.addedAgeExcludes.join('\n')}\n`;
+        }
         return {
             exitCode: result.remaining.length > 0 ? 1 : 0,
-            output: formatFixWithUpdateOutput(result, auditReport),
+            output,
         };
     }
     if (fixMethod === 'override') {
-        const newOverrides = await fix(auditReport, opts);
-        if (Object.values(newOverrides).length === 0) {
+        const { vulnOverrides, addedAgeExcludes } = await fix(auditReport, opts);
+        if (Object.values(vulnOverrides).length === 0) {
             return {
                 exitCode: 0,
                 output: 'No fixes were made',
             };
         }
-        return {
-            exitCode: 0,
-            output: `${Object.values(newOverrides).length} overrides were added to package.json to fix vulnerabilities.
+        let output = `${Object.values(vulnOverrides).length} overrides were added to pnpm-workspace.yaml to fix vulnerabilities.
 Run "pnpm install" to apply the fixes.
 
 The added overrides:
-${JSON.stringify(newOverrides, null, 2)}`,
+${JSON.stringify(vulnOverrides, null, 2)}`;
+        if (addedAgeExcludes.length > 0) {
+            output += `\n\n${addedAgeExcludes.length} entries were added to minimumReleaseAgeExclude to allow installing the patched versions:\n${addedAgeExcludes.join('\n')}`;
+        }
+        return {
+            exitCode: 0,
+            output,
         };
     }
     if (opts.ignore !== undefined || opts.ignoreUnfixable) {

package/lib/audit/fix.d.ts

@@ -1,3 +1,8 @@
-import type { AuditReport } from '@pnpm/deps.compliance.audit';
+import type { AuditAdvisory, AuditReport } from '@pnpm/deps.compliance.audit';
 import type { AuditOptions } from './audit.js';
-export declare function fix(auditReport: AuditReport, opts: AuditOptions): Promise<Record<string, string>>;
+export interface FixResult {
+    vulnOverrides: Record<string, string>;
+    addedAgeExcludes: string[];
+}
+export declare function fix(auditReport: AuditReport, opts: AuditOptions): Promise<FixResult>;
+export declare function createMinimumReleaseAgeExcludes(advisories: AuditAdvisory[]): string[];

package/lib/audit/fix.js

@@ -1,26 +1,46 @@
 import { writeSettings } from '@pnpm/config.writer';
 import { difference } from 'ramda';
+import semver from 'semver';
 export async function fix(auditReport, opts) {
-    const vulnOverrides = createOverrides(Object.values(auditReport.advisories), opts.auditConfig?.ignoreCves);
+    const fixableAdvisories = getFixableAdvisories(Object.values(auditReport.advisories), opts.auditConfig?.ignoreCves);
+    const vulnOverrides = createOverrides(fixableAdvisories);
     if (Object.values(vulnOverrides).length === 0)
-        return vulnOverrides;
+        return { vulnOverrides, addedAgeExcludes: [] };
+    const addedAgeExcludes = opts.minimumReleaseAge ? createMinimumReleaseAgeExcludes(fixableAdvisories) : [];
     await writeSettings({
         updatedOverrides: vulnOverrides,
+        addedMinimumReleaseAgeExcludes: addedAgeExcludes.length > 0 ? addedAgeExcludes : undefined,
         rootProjectManifest: opts.rootProjectManifest,
         rootProjectManifestDir: opts.rootProjectManifestDir,
         workspaceDir: opts.workspaceDir ?? opts.rootProjectManifestDir,
     });
-    return vulnOverrides;
+    return { vulnOverrides, addedAgeExcludes };
 }
-function createOverrides(advisories, ignoreCves) {
+function getFixableAdvisories(advisories, ignoreCves) {
     if (ignoreCves) {
         advisories = advisories.filter(({ cves }) => difference(cves, ignoreCves).length > 0);
     }
-    return Object.fromEntries(advisories
-        .filter(({ vulnerable_versions: vulnerableVersions, patched_versions: patchedVersions }) => vulnerableVersions !== '>=0.0.0' && patchedVersions !== '<0.0.0')
-        .map((advisory) => [
+    return advisories
+        .filter(({ vulnerable_versions: vulnerableVersions, patched_versions: patchedVersions }) => vulnerableVersions !== '>=0.0.0' && patchedVersions !== '<0.0.0');
+}
+function createOverrides(advisories) {
+    return Object.fromEntries(advisories.map((advisory) => [
         `${advisory.module_name}@${advisory.vulnerable_versions}`,
         advisory.patched_versions,
     ]));
 }
+export function createMinimumReleaseAgeExcludes(advisories) {
+    const excludes = new Set();
+    for (const advisory of advisories) {
+        if (advisory.patched_versions === '<0.0.0')
+            continue;
+        if (advisory.vulnerable_versions === '>=0.0.0' || advisory.vulnerable_versions === '*')
+            continue;
+        const minVersion = semver.minVersion(advisory.patched_versions);
+        if (minVersion) {
+            excludes.add(`${advisory.module_name}@${minVersion.version}`);
+        }
+    }
+    return Array.from(excludes);
+}
 //# sourceMappingURL=fix.js.map

package/lib/audit/fixWithUpdate.d.ts

@@ -4,6 +4,7 @@ import type { AuditOptions } from './audit.js';
 export interface FixWithUpdateResult {
     fixed: number[];
     remaining: number[];
+    addedAgeExcludes: string[];
 }
 export type FixWithUpdateOptions = AuditOptions & {
     include?: {

package/lib/audit/fixWithUpdate.js

@@ -1,8 +1,10 @@
+import { writeSettings } from '@pnpm/config.writer';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
 import { PnpmError } from '@pnpm/error';
 import { update } from '@pnpm/installing.commands';
 import { readWantedLockfile } from '@pnpm/lockfile.fs';
 import semver from 'semver';
+import { createMinimumReleaseAgeExcludes } from './fix.js';
 import { lockfileToPackages } from './lockfileToPackages.js';
 export async function fixWithUpdate(auditReport, opts) {
     const vulnerabilitiesByPackage = new Map();
@@ -58,8 +60,22 @@ export async function fixWithUpdate(auditReport, opts) {
             return allVulnerabilities;
         },
     };
+    // Add minimum patched versions to minimumReleaseAgeExclude so the resolver
+    // can install them even when minimumReleaseAge would otherwise block them.
+    const addedAgeExcludes = opts.minimumReleaseAge ? createMinimumReleaseAgeExcludes(Object.values(auditReport.advisories)) : [];
+    const updateOpts = { ...opts };
+    if (addedAgeExcludes.length > 0) {
+        const existing = updateOpts.minimumReleaseAgeExclude ?? [];
+        updateOpts.minimumReleaseAgeExclude = [...existing, ...addedAgeExcludes];
+        await writeSettings({
+            addedMinimumReleaseAgeExcludes: addedAgeExcludes,
+            rootProjectManifest: opts.rootProjectManifest,
+            rootProjectManifestDir: opts.rootProjectManifestDir,
+            workspaceDir: opts.workspaceDir ?? opts.rootProjectManifestDir,
+        });
+    }
     await update.handler({
-        ...opts,
+        ...updateOpts,
         packageVulnerabilityAudit,
     }, []);
     const lockfileDir = opts.lockfileDir ?? opts.dir;
@@ -105,6 +121,6 @@ export async function fixWithUpdate(auditReport, opts) {
             fixed.push(...unfixableIds);
         }
     }
-    return { fixed, remaining };
+    return { fixed, remaining, addedAgeExcludes };
 }
 //# sourceMappingURL=fixWithUpdate.js.map

package/lib/licenses/licensesList.d.ts

@@ -1,9 +1,9 @@
-import type { Config } from '@pnpm/config.reader';
+import type { Config, ConfigContext } from '@pnpm/config.reader';
 import type { LicensesCommandResult } from './LicensesCommandResult.js';
 export type LicensesCommandOptions = {
     compatible?: boolean;
     long?: boolean;
     recursive?: boolean;
     json?: boolean;
-} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'supportedArchitectures' | 'virtualStoreDirMaxLength'> & Partial<Pick<Config, 'userConfig'>>;
+} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'supportedArchitectures' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir'> & Partial<Pick<Config, 'userConfig'>>;
 export declare function licensesList(opts: LicensesCommandOptions): Promise<LicensesCommandResult>;

package/lib/sbom/sbom.d.ts

@@ -1,11 +1,11 @@
-import { type Config } from '@pnpm/config.reader';
+import { type Config, type ConfigContext } from '@pnpm/config.reader';
 export type SbomCommandOptions = {
     sbomFormat?: string;
     sbomType?: string;
     lockfileOnly?: boolean;
     sbomAuthors?: string;
     sbomSupplier?: string;
-} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir' | 'virtualStoreDirMaxLength'> & Partial<Pick<Config, 'userConfig'>>;
+} & Pick<Config, 'dev' | 'dir' | 'lockfileDir' | 'registries' | 'optional' | 'production' | 'storeDir' | 'virtualStoreDir' | 'modulesDir' | 'pnpmHomeDir' | 'virtualStoreDirMaxLength'> & Pick<ConfigContext, 'selectedProjectsGraph' | 'rootProjectManifest' | 'rootProjectManifestDir'> & Partial<Pick<Config, 'userConfig'>>;
 export declare function rcOptionsTypes(): Record<string, unknown>;
 export declare const cliOptionsTypes: () => Record<string, unknown>;
 export declare const shorthands: Record<string, string>;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.commands",
-  "version": "1000.0.0",
+  "version": "1100.0.0",
   "description": "pnpm commands for audit, licenses, and sbom",
   "keywords": [
     "pnpm",
@@ -33,41 +33,43 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "semver": "^7.7.2",
-    "@pnpm/cli.command": "1000.0.0",
-    "@pnpm/cli.common-cli-options-help": "1000.0.1",
-    "@pnpm/cli.utils": "1001.2.8",
-    "@pnpm/config.reader": "1004.4.2",
-    "@pnpm/cli.meta": "1000.0.11",
-    "@pnpm/constants": "1001.3.1",
-    "@pnpm/deps.compliance.audit": "1002.0.14",
-    "@pnpm/deps.compliance.license-scanner": "1001.0.27",
-    "@pnpm/deps.compliance.sbom": "1000.0.0-0",
-    "@pnpm/error": "1000.0.5",
-    "@pnpm/installing.commands": "1004.6.10",
-    "@pnpm/lockfile.fs": "1001.1.21",
-    "@pnpm/config.writer": "1000.0.14",
-    "@pnpm/lockfile.utils": "1003.0.3",
-    "@pnpm/lockfile.types": "1002.0.2",
-    "@pnpm/store.path": "1000.0.5",
-    "@pnpm/network.auth-header": "1000.0.6",
-    "@pnpm/types": "1000.9.0",
-    "@pnpm/lockfile.walker": "1001.0.16",
-    "@pnpm/workspace.project-manifest-reader": "1001.1.4"
+    "@pnpm/cli.command": "1100.0.0",
+    "@pnpm/cli.common-cli-options-help": "1100.0.0",
+    "@pnpm/cli.meta": "1100.0.0",
+    "@pnpm/config.writer": "1100.0.0",
+    "@pnpm/constants": "1100.0.0",
+    "@pnpm/deps.compliance.audit": "1100.0.0",
+    "@pnpm/deps.compliance.license-scanner": "1100.0.0",
+    "@pnpm/config.reader": "1100.0.0",
+    "@pnpm/deps.compliance.sbom": "1100.0.0",
+    "@pnpm/error": "1100.0.0",
+    "@pnpm/installing.commands": "1100.0.0",
+    "@pnpm/lockfile.fs": "1100.0.0",
+    "@pnpm/lockfile.types": "1100.0.0",
+    "@pnpm/lockfile.utils": "1100.0.0",
+    "@pnpm/lockfile.walker": "1100.0.0",
+    "@pnpm/cli.utils": "1100.0.0",
+    "@pnpm/store.path": "1100.0.0",
+    "@pnpm/network.auth-header": "1100.0.0",
+    "@pnpm/types": "1100.0.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.0"
   },
   "devDependencies": {
-    "@pnpm/registry-mock": "5.2.4",
-    "@types/ramda": "0.29.12",
+    "@pnpm/registry-mock": "6.0.0",
+    "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
     "@types/zkochan__table": "npm:@types/table@6.0.0",
     "load-json-file": "^7.0.1",
     "nock": "13.3.4",
     "read-yaml-file": "^3.0.0",
     "tempy": "3.0.0",
-    "@pnpm/deps.compliance.commands": "1000.0.0",
-    "@pnpm/pkg-manifest.reader": "1000.1.2",
-    "@pnpm/workspace.projects-filter": "1000.0.43",
-    "@pnpm/test-fixtures": "1000.0.0",
-    "@pnpm/prepare": "1000.0.4"
+    "@pnpm/deps.compliance.commands": "1100.0.0",
+    "@pnpm/prepare": "1100.0.0",
+    "@pnpm/pkg-manifest.reader": "1100.0.0",
+    "@pnpm/testing.command-defaults": "1100.0.0",
+    "@pnpm/testing.mock-agent": "1100.0.0",
+    "@pnpm/workspace.projects-filter": "1100.0.0",
+    "@pnpm/test-fixtures": "1100.0.0"
   },
   "engines": {
     "node": ">=22.13"
@@ -77,9 +79,9 @@
   },
   "scripts": {
     "lint": "eslint \"src/**/*.ts\" \"test/**/*.ts\"",
-    "_test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest",
-    "test": "pnpm run compile && pnpm run _test",
-    "compile": "tsgo --build && pnpm run lint --fix",
-    "update-responses": "node test/audit/utils/responses/update.ts"
+    "test": "pn compile && pn .test",
+    "compile": "tsgo --build && pn lint --fix",
+    "update-responses": "node test/audit/utils/responses/update.ts",
+    ".test": "cross-env NODE_OPTIONS=\"$NODE_OPTIONS --experimental-vm-modules --disable-warning=ExperimentalWarning --disable-warning=DEP0169\" jest"
   }
 }