@pnpm/deps.compliance.commands 1100.0.0 → 1101.0.1

package/lib/audit/audit.js

@@ -1,25 +1,27 @@
 import { docsUrl, TABLE_OPTIONS } from '@pnpm/cli.utils';
 import { types as allTypes } from '@pnpm/config.reader';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
-import { audit } from '@pnpm/deps.compliance.audit';
+import { audit, normalizeGhsaId } from '@pnpm/deps.compliance.audit';
 import { PnpmError } from '@pnpm/error';
 import { update } from '@pnpm/installing.commands';
 import { readEnvLockfile, readWantedLockfile } from '@pnpm/lockfile.fs';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { table } from '@zkochan/table';
 import chalk, {} from 'chalk';
-import { difference, pick, pickBy } from 'ramda';
+import { pick, pickBy } from 'ramda';
 import { renderHelp } from 'render-help';
 import { fix } from './fix.js';
 import { fixWithUpdate } from './fixWithUpdate.js';
 import { ignore } from './ignore.js';
 const AUDIT_LEVEL_NUMBER = {
-    low: 0,
-    moderate: 1,
-    high: 2,
-    critical: 3,
+    info: 0,
+    low: 1,
+    moderate: 2,
+    high: 3,
+    critical: 4,
 };
 const AUDIT_COLOR = {
+    info: chalk.dim,
     low: chalk.bold,
     moderate: chalk.bold.yellow,
     high: chalk.bold.red,
@@ -46,7 +48,7 @@ export function rcOptionsTypes() {
             'production',
             'registry',
         ], allTypes),
-        'audit-level': ['low', 'moderate', 'high', 'critical'],
+        'audit-level': ['info', 'low', 'moderate', 'high', 'critical'],
         // For fix, use String instead of a list of allowed string values.
         // Otherwise, an unexpected value will get coerced to true because of the Boolean type.
         fix: [String, Boolean],
@@ -86,7 +88,7 @@ export function help() {
                         name: '--json',
                     },
                     {
-                        description: 'Only print advisories with severity greater than or equal to one of the following: low|moderate|high|critical. Default: low',
+                        description: 'Only print advisories with severity greater than or equal to one of the following: info|low|moderate|high|critical. Default: low',
                         name: '--audit-level <severity>',
                     },
                     {
@@ -108,11 +110,11 @@ export function help() {
                         name: '--ignore-registry-errors',
                     },
                     {
-                        description: 'Ignore a vulnerability by CVE',
+                        description: 'Ignore a vulnerability by its GitHub advisory ID (e.g. GHSA-xxxx-xxxx-xxxx)',
                         name: '--ignore <vulnerability>',
                     },
                     {
-                        description: 'Ignore all CVEs with no resolution',
+                        description: 'Ignore all vulnerabilities for which no fix exists',
                         name: '--ignore-unfixable',
                     },
                 ],
@@ -153,7 +155,6 @@ export async function handler(opts) {
             },
             envLockfile,
             include,
-            lockfileDir,
             registry: opts.registries.default,
             retry: {
                 factor: opts.fetchRetryFactor,
@@ -162,7 +163,6 @@ export async function handler(opts) {
                 retries: opts.fetchRetries,
             },
             timeout: opts.fetchTimeout,
-            virtualStoreDirMaxLength: opts.virtualStoreDirMaxLength,
         });
     }
     catch (err) { // eslint-disable-line
@@ -244,6 +244,7 @@ ${newIgnores.join('\n')}`,
     }
     const vulnerabilities = auditReport.metadata.vulnerabilities;
     const ignoredVulnerabilities = {
+        info: 0,
         low: 0,
         moderate: 0,
         high: 0,
@@ -252,19 +253,12 @@ ${newIgnores.join('\n')}`,
     const totalVulnerabilityCount = Object.values(vulnerabilities)
         .reduce((sum, vulnerabilitiesCount) => sum + vulnerabilitiesCount, 0);
     const ignoreGhsas = opts.auditConfig?.ignoreGhsas;
-    if (ignoreGhsas) {
+    if (ignoreGhsas?.length) {
+        // Compare GHSA ids after normalizing so stored entries with varying
+        // casing still match the canonical form on the advisory.
+        const ignoreSet = new Set(ignoreGhsas.map(normalizeGhsaId));
         auditReport.advisories = pickBy(({ github_advisory_id: githubAdvisoryId, severity }) => {
-            if (!ignoreGhsas.includes(githubAdvisoryId)) {
-                return true;
-            }
-            ignoredVulnerabilities[severity] += 1;
-            return false;
-        }, auditReport.advisories);
-    }
-    const ignoreCves = opts.auditConfig?.ignoreCves;
-    if (ignoreCves) {
-        auditReport.advisories = pickBy(({ cves, severity }) => {
-            if (cves.length === 0 || difference(cves, ignoreCves).length > 0) {
+            if (!ignoreSet.has(normalizeGhsaId(githubAdvisoryId))) {
                 return true;
             }
             ignoredVulnerabilities[severity] += 1;
@@ -289,7 +283,7 @@ ${newIgnores.join('\n')}`,
             [AUDIT_COLOR[advisory.severity](advisory.severity), chalk.bold(advisory.title)],
             ['Package', advisory.module_name],
             ['Vulnerable versions', advisory.vulnerable_versions],
-            ['Patched versions', advisory.patched_versions],
+            ['Patched versions', advisory.patched_versions ?? '(unknown)'],
             [
                 'Paths',
                 (paths.length > MAX_PATHS_COUNT

package/lib/audit/fix.d.ts

@@ -1,4 +1,4 @@
-import type { AuditAdvisory, AuditReport } from '@pnpm/deps.compliance.audit';
+import { type AuditAdvisory, type AuditReport } from '@pnpm/deps.compliance.audit';
 import type { AuditOptions } from './audit.js';
 export interface FixResult {
     vulnOverrides: Record<string, string>;

package/lib/audit/fix.js

@@ -1,8 +1,8 @@
 import { writeSettings } from '@pnpm/config.writer';
-import { difference } from 'ramda';
+import { normalizeGhsaId } from '@pnpm/deps.compliance.audit';
 import semver from 'semver';
 export async function fix(auditReport, opts) {
-    const fixableAdvisories = getFixableAdvisories(Object.values(auditReport.advisories), opts.auditConfig?.ignoreCves);
+    const fixableAdvisories = getFixableAdvisories(Object.values(auditReport.advisories), opts.auditConfig?.ignoreGhsas);
     const vulnOverrides = createOverrides(fixableAdvisories);
     if (Object.values(vulnOverrides).length === 0)
         return { vulnOverrides, addedAgeExcludes: [] };
@@ -16,27 +16,33 @@ export async function fix(auditReport, opts) {
     });
     return { vulnOverrides, addedAgeExcludes };
 }
-function getFixableAdvisories(advisories, ignoreCves) {
-    if (ignoreCves) {
-        advisories = advisories.filter(({ cves }) => difference(cves, ignoreCves).length > 0);
+function getFixableAdvisories(advisories, ignoreGhsas) {
+    if (ignoreGhsas) {
+        // Normalize on both sides so ignore entries match regardless of casing.
+        const ignored = new Set(ignoreGhsas.map(normalizeGhsaId));
+        advisories = advisories.filter(({ github_advisory_id: ghsaId }) => !ghsaId || !ignored.has(normalizeGhsaId(ghsaId)));
     }
-    return advisories
-        .filter(({ vulnerable_versions: vulnerableVersions, patched_versions: patchedVersions }) => vulnerableVersions !== '>=0.0.0' && patchedVersions !== '<0.0.0');
+    // Only advisories with a known patched range can produce an override.
+    // patched_versions is undefined when the range couldn't be inferred from
+    // vulnerable_versions — no override is possible in that case.
+    return advisories.filter(({ patched_versions: patchedVersions }) => patchedVersions != null);
 }
 function createOverrides(advisories) {
-    return Object.fromEntries(advisories.map((advisory) => [
-        `${advisory.module_name}@${advisory.vulnerable_versions}`,
-        advisory.patched_versions,
-    ]));
+    const entries = [];
+    for (const advisory of advisories) {
+        if (!advisory.patched_versions)
+            continue;
+        entries.push([`${advisory.module_name}@${advisory.vulnerable_versions}`, advisory.patched_versions]);
+    }
+    return Object.fromEntries(entries);
 }
 export function createMinimumReleaseAgeExcludes(advisories) {
     const excludes = new Set();
     for (const advisory of advisories) {
-        if (advisory.patched_versions === '<0.0.0')
-            continue;
-        if (advisory.vulnerable_versions === '>=0.0.0' || advisory.vulnerable_versions === '*')
+        const patchedVersions = advisory.patched_versions;
+        if (!patchedVersions)
             continue;
-        const minVersion = semver.minVersion(advisory.patched_versions);
+        const minVersion = semver.minVersion(patchedVersions);
         if (minVersion) {
             excludes.add(`${advisory.module_name}@${minVersion.version}`);
         }

package/lib/audit/ignore.d.ts

@@ -1,4 +1,4 @@
-import type { AuditReport } from '@pnpm/deps.compliance.audit';
+import { type AuditReport } from '@pnpm/deps.compliance.audit';
 import type { AuditConfig, ProjectManifest } from '@pnpm/types';
 export interface IgnoreVulnerabilitiesOptions {
     dir: string;

package/lib/audit/ignore.js

@@ -1,31 +1,44 @@
 import { writeSettings } from '@pnpm/config.writer';
+import { normalizeGhsaId } from '@pnpm/deps.compliance.audit';
+import { PnpmError } from '@pnpm/error';
 import { difference } from 'ramda';
 export async function ignore(opts) {
-    const currentCves = opts?.auditConfig?.ignoreCves ?? [];
-    const currentUniqueCves = new Set(currentCves);
-    const advisoryWthNoResolutions = filterAdvisoriesWithNoResolutions(Object.values(opts.auditReport.advisories));
+    // GHSA IDs are canonically uppercase; normalize on read/write so a stored
+    // "ghsa-..." or uppercase user input both match the derived id at filter
+    // time.
+    const currentGhsas = (opts?.auditConfig?.ignoreGhsas ?? []).map(normalizeGhsaId);
+    const currentUniqueGhsas = new Set(currentGhsas);
+    const advisoriesWithNoResolutions = filterAdvisoriesWithNoResolutions(Object.values(opts.auditReport.advisories));
     if (opts.ignoreUnfixable) {
-        Object.values(advisoryWthNoResolutions).forEach((advisory) => {
-            advisory.cves.forEach((cve) => currentUniqueCves.add(cve));
-        });
+        for (const advisory of advisoriesWithNoResolutions) {
+            if (!advisory.github_advisory_id) {
+                throw new PnpmError('AUDIT_MISSING_GHSA', `Cannot ignore advisory ${advisory.id} (${advisory.module_name}): the registry did not provide a GHSA id or a resolvable url.`);
+            }
+            currentUniqueGhsas.add(normalizeGhsaId(advisory.github_advisory_id));
+        }
     }
-    else {
-        opts.ignore?.forEach((cve) => currentUniqueCves.add(cve));
+    else if (opts.ignore) {
+        for (const ghsa of opts.ignore) {
+            currentUniqueGhsas.add(normalizeGhsaId(ghsa));
+        }
     }
-    const newIgnoreCves = currentUniqueCves.size > 0 ? Array.from(currentUniqueCves) : undefined;
-    const diffCve = difference(newIgnoreCves ?? [], currentCves);
+    const newIgnoreGhsas = currentUniqueGhsas.size > 0 ? Array.from(currentUniqueGhsas) : undefined;
+    const diffGhsas = difference(newIgnoreGhsas ?? [], currentGhsas);
     await writeSettings({
         ...opts,
         updatedSettings: {
             auditConfig: {
                 ...opts.auditConfig,
-                ignoreCves: newIgnoreCves,
+                ignoreGhsas: newIgnoreGhsas,
             },
         },
     });
-    return [...diffCve];
+    return [...diffGhsas];
 }
+// Advisories for which no override can be produced — patched_versions is
+// undefined when pnpm couldn't infer a patched range from vulnerable_versions.
+// That is the only "no fix available" signal the bulk endpoint provides.
 function filterAdvisoriesWithNoResolutions(advisories) {
-    return advisories.filter(({ patched_versions: patchedVersions }) => patchedVersions === '<0.0.0');
+    return advisories.filter(({ patched_versions: patchedVersions }) => patchedVersions == null);
 }
 //# sourceMappingURL=ignore.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.commands",
-  "version": "1100.0.0",
+  "version": "1101.0.1",
   "description": "pnpm commands for audit, licenses, and sbom",
   "keywords": [
     "pnpm",
@@ -33,26 +33,26 @@
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "semver": "^7.7.2",
-    "@pnpm/cli.command": "1100.0.0",
     "@pnpm/cli.common-cli-options-help": "1100.0.0",
-    "@pnpm/cli.meta": "1100.0.0",
-    "@pnpm/config.writer": "1100.0.0",
+    "@pnpm/cli.utils": "1101.0.0",
+    "@pnpm/cli.command": "1100.0.0",
+    "@pnpm/cli.meta": "1100.0.1",
+    "@pnpm/config.reader": "1101.0.0",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.compliance.audit": "1100.0.0",
-    "@pnpm/deps.compliance.license-scanner": "1100.0.0",
-    "@pnpm/config.reader": "1100.0.0",
-    "@pnpm/deps.compliance.sbom": "1100.0.0",
+    "@pnpm/config.writer": "1100.0.1",
+    "@pnpm/deps.compliance.license-scanner": "1100.0.2",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/installing.commands": "1100.0.0",
-    "@pnpm/lockfile.fs": "1100.0.0",
-    "@pnpm/lockfile.types": "1100.0.0",
-    "@pnpm/lockfile.utils": "1100.0.0",
-    "@pnpm/lockfile.walker": "1100.0.0",
-    "@pnpm/cli.utils": "1100.0.0",
+    "@pnpm/lockfile.fs": "1100.0.1",
+    "@pnpm/deps.compliance.sbom": "1100.0.2",
+    "@pnpm/installing.commands": "1100.1.0",
+    "@pnpm/deps.compliance.audit": "1101.0.0",
+    "@pnpm/lockfile.utils": "1100.0.1",
+    "@pnpm/network.auth-header": "1100.0.1",
+    "@pnpm/lockfile.types": "1100.0.1",
     "@pnpm/store.path": "1100.0.0",
-    "@pnpm/network.auth-header": "1100.0.0",
-    "@pnpm/types": "1100.0.0",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.0"
+    "@pnpm/types": "1101.0.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.2",
+    "@pnpm/lockfile.walker": "1100.0.1"
   },
   "devDependencies": {
     "@pnpm/registry-mock": "6.0.0",
@@ -63,13 +63,13 @@
     "nock": "13.3.4",
     "read-yaml-file": "^3.0.0",
     "tempy": "3.0.0",
-    "@pnpm/deps.compliance.commands": "1100.0.0",
-    "@pnpm/prepare": "1100.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.0",
+    "@pnpm/deps.compliance.commands": "1101.0.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.1",
+    "@pnpm/prepare": "1100.0.1",
+    "@pnpm/testing.mock-agent": "1100.0.1",
     "@pnpm/testing.command-defaults": "1100.0.0",
-    "@pnpm/testing.mock-agent": "1100.0.0",
-    "@pnpm/workspace.projects-filter": "1100.0.0",
-    "@pnpm/test-fixtures": "1100.0.0"
+    "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/workspace.projects-filter": "1100.0.2"
   },
   "engines": {
     "node": ">=22.13"