@pnpm/deps.compliance.commands 1101.0.0 → 1101.1.0

package/lib/audit/audit.d.ts

@@ -12,6 +12,7 @@ export declare function help(): string;
 export type AuditOptions = Pick<UniversalOptions, 'dir'> & {
     fix?: boolean | 'override' | 'update';
     ignoreRegistryErrors?: boolean;
+    interactive?: boolean;
     json?: boolean;
     lockfileDir?: string;
     registries: Registries;

package/lib/audit/audit.js

@@ -5,13 +5,16 @@ import { audit, normalizeGhsaId } from '@pnpm/deps.compliance.audit';
 import { PnpmError } from '@pnpm/error';
 import { update } from '@pnpm/installing.commands';
 import { readEnvLockfile, readWantedLockfile } from '@pnpm/lockfile.fs';
+import { globalInfo } from '@pnpm/logger';
 import { createGetAuthHeaderByURI } from '@pnpm/network.auth-header';
 import { table } from '@zkochan/table';
 import chalk, {} from 'chalk';
+import enquirer from 'enquirer';
 import { pick, pickBy } from 'ramda';
 import { renderHelp } from 'render-help';
 import { fix } from './fix.js';
 import { fixWithUpdate } from './fixWithUpdate.js';
+import { getAuditFixChoices } from './getAuditFixChoices.js';
 import { ignore } from './ignore.js';
 const AUDIT_LEVEL_NUMBER = {
     info: 0,
@@ -64,6 +67,7 @@ export function cliOptionsTypes() {
             'workspace',
         ], update.cliOptionsTypes()),
         ...rcOptionsTypes(),
+        interactive: Boolean,
     };
 }
 export const shorthands = {
@@ -117,6 +121,11 @@ export function help() {
                         description: 'Ignore all vulnerabilities for which no fix exists',
                         name: '--ignore-unfixable',
                     },
+                    {
+                        description: 'Show vulnerabilities and select which ones to fix interactively',
+                        name: '--interactive',
+                        shortAlias: '-i',
+                    },
                 ],
             },
         ],
@@ -178,7 +187,7 @@ export async function handler(opts) {
     if (opts.fix === 'update' || opts.fix === 'override') {
         fixMethod = opts.fix;
     }
-    else if (opts.fix === true) {
+    else if (opts.fix === true || (opts.interactive && !opts.fix)) {
         fixMethod = DEFAULT_FIX_METHOD;
     }
     else if (!opts.fix) {
@@ -187,19 +196,29 @@ export async function handler(opts) {
     else {
         throw new PnpmError('INVALID_FIX_OPTION', `Invalid value for --fix: ${opts.fix}. Should be one of "override" or "update"`);
     }
-    if (fixMethod === 'update') {
-        const result = await fixWithUpdate(auditReport, { ...opts, include });
-        let output = formatFixWithUpdateOutput(result, auditReport);
-        if (result.addedAgeExcludes.length > 0) {
-            output += `\n${result.addedAgeExcludes.length} entries were added to minimumReleaseAgeExclude to allow installing the patched versions:\n${result.addedAgeExcludes.join('\n')}\n`;
-        }
-        return {
-            exitCode: result.remaining.length > 0 ? 1 : 0,
-            output,
+    if (fixMethod != null) {
+        // Pre-filter by auditLevel and ignoreGhsas so the interactive prompt
+        // and the update-method path see the same set of advisories that
+        // fix.ts's getFixableAdvisories filters for the override path.
+        let filteredAuditReport = {
+            ...auditReport,
+            advisories: filterAdvisoriesForFix(auditReport.advisories, opts),
         };
-    }
-    if (fixMethod === 'override') {
-        const { vulnOverrides, addedAgeExcludes } = await fix(auditReport, opts);
+        if (opts.interactive) {
+            filteredAuditReport = await interactiveAuditFix(filteredAuditReport);
+        }
+        if (fixMethod === 'update') {
+            const result = await fixWithUpdate(filteredAuditReport, { ...opts, include });
+            let output = formatFixWithUpdateOutput(result, filteredAuditReport);
+            if (result.addedAgeExcludes.length > 0) {
+                output += `\n${result.addedAgeExcludes.length} entries were added to minimumReleaseAgeExclude to allow installing the patched versions:\n${result.addedAgeExcludes.join('\n')}\n`;
+            }
+            return {
+                exitCode: result.remaining.length > 0 ? 1 : 0,
+                output,
+            };
+        }
+        const { vulnOverrides, addedAgeExcludes } = await fix(filteredAuditReport, opts);
         if (Object.values(vulnOverrides).length === 0) {
             return {
                 exitCode: 0,
@@ -350,4 +369,78 @@ export function formatFixWithUpdateOutput(result, auditReport) {
     output.push('');
     return output.join('\n');
 }
+function filterAdvisoriesForFix(advisories, opts) {
+    const auditLevel = AUDIT_LEVEL_NUMBER[opts.auditLevel ?? 'low'];
+    const ignoreGhsas = opts.auditConfig?.ignoreGhsas;
+    const ignoreGhsaSet = ignoreGhsas?.length ? new Set(ignoreGhsas.map(normalizeGhsaId)) : undefined;
+    return Object.fromEntries(Object.entries(advisories).filter(([, { severity, github_advisory_id: ghsaId }]) => {
+        if (AUDIT_LEVEL_NUMBER[severity] < auditLevel)
+            return false;
+        if (ignoreGhsaSet && ghsaId && ignoreGhsaSet.has(normalizeGhsaId(ghsaId)))
+            return false;
+        return true;
+    }));
+}
+async function interactiveAuditFix(auditReport) {
+    const choices = getAuditFixChoices(Object.values(auditReport.advisories));
+    if (choices.length === 0) {
+        return auditReport;
+    }
+    const { selectedVulnerabilities } = await enquirer.prompt({
+        choices,
+        footer: '\nEnter to start fixing. Ctrl-c to cancel.',
+        indicator(state, choice) {
+            return ` ${choice.enabled ? '●' : '○'}`;
+        },
+        message: 'Choose which vulnerabilities to fix ' +
+            `(Press ${chalk.cyan('<space>')} to select, ` +
+            `${chalk.cyan('<a>')} to toggle all, ` +
+            `${chalk.cyan('<i>')} to invert selection)`,
+        name: 'selectedVulnerabilities',
+        pointer: '❯',
+        result() {
+            return this.selected;
+        },
+        format() {
+            if (!this.state.submitted || this.state.cancelled)
+                return '';
+            if (Array.isArray(this.selected)) {
+                return this.selected
+                    .filter((choice) => !/^\[.+\]$/.test(choice.name))
+                    .map((choice) => this.styles.primary(choice.name)).join(', ');
+            }
+            return this.styles.primary(this.selected.name);
+        },
+        styles: {
+            dark: chalk.reset,
+            em: chalk.bgBlack.whiteBright,
+            success: chalk.reset,
+        },
+        type: 'multiselect',
+        validate(value) {
+            if (value.length === 0) {
+                return 'You must choose at least one vulnerability.';
+            }
+            return true;
+        },
+        j() {
+            return this.down();
+        },
+        k() {
+            return this.up();
+        },
+        cancel() {
+            // By default, canceling the prompt via Ctrl+c throws an empty string.
+            // The custom cancel function prevents that behavior.
+            // Otherwise, pnpm CLI would print an error and confuse users.
+            // See related issue: https://github.com/enquirer/enquirer/issues/225
+            globalInfo('Audit fix canceled');
+            process.exit(0);
+        },
+    }); // eslint-disable-line @typescript-eslint/no-explicit-any
+    const selectedKeys = new Set(selectedVulnerabilities.map((c) => c.value));
+    const selectedAdvisories = Object.fromEntries(Object.entries(auditReport.advisories)
+        .filter(([, advisory]) => selectedKeys.has(`${advisory.module_name}@${advisory.vulnerable_versions}`)));
+    return { ...auditReport, advisories: selectedAdvisories };
+}
 //# sourceMappingURL=audit.js.map

package/lib/audit/fix.d.ts

@@ -5,4 +5,5 @@ export interface FixResult {
     addedAgeExcludes: string[];
 }
 export declare function fix(auditReport: AuditReport, opts: AuditOptions): Promise<FixResult>;
+export declare function caretRangeForPatched(patchedRange: string): string;
 export declare function createMinimumReleaseAgeExcludes(advisories: AuditAdvisory[]): string[];

package/lib/audit/fix.js

@@ -32,10 +32,18 @@ function createOverrides(advisories) {
     for (const advisory of advisories) {
         if (!advisory.patched_versions)
             continue;
-        entries.push([`${advisory.module_name}@${advisory.vulnerable_versions}`, advisory.patched_versions]);
+        entries.push([`${advisory.module_name}@${advisory.vulnerable_versions}`, caretRangeForPatched(advisory.patched_versions)]);
     }
     return Object.fromEntries(entries);
 }
+// Use the minimum patched version with a caret so pnpm stays within the
+// same major as the fix. `>=X.Y.Z` alone can silently promote a dep to a
+// later breaking major; `^X.Y.Z` still satisfies the patch while
+// preserving the major the user originally pinned to.
+export function caretRangeForPatched(patchedRange) {
+    const min = semver.minVersion(patchedRange);
+    return min ? `^${min.version}` : patchedRange;
+}
 export function createMinimumReleaseAgeExcludes(advisories) {
     const excludes = new Set();
     for (const advisory of advisories) {

package/lib/audit/getAuditFixChoices.d.ts

@@ -0,0 +1,14 @@
+import type { AuditAdvisory } from '@pnpm/deps.compliance.audit';
+export interface AuditChoiceRow {
+    name: string;
+    value: string;
+    disabled?: boolean;
+}
+type AuditChoiceGroup = Array<{
+    name: string;
+    message: string;
+    choices: AuditChoiceRow[];
+    disabled?: boolean;
+}>;
+export declare function getAuditFixChoices(advisories: AuditAdvisory[]): AuditChoiceGroup;
+export {};

package/lib/audit/getAuditFixChoices.js

@@ -0,0 +1,116 @@
+import { getBorderCharacters, table } from '@zkochan/table';
+import chalk from 'chalk';
+import { groupBy } from 'ramda';
+import { caretRangeForPatched } from './fix.js';
+const AUDIT_COLOR = {
+    info: chalk.dim,
+    low: chalk.bold,
+    moderate: chalk.bold.yellow,
+    high: chalk.bold.red,
+    critical: chalk.bold.red,
+};
+const SEVERITY_ORDER = ['critical', 'high', 'moderate', 'low', 'info'];
+const SEVERITY_RANK = {
+    info: 0,
+    low: 1,
+    moderate: 2,
+    high: 3,
+    critical: 4,
+};
+const COLUMN_HEADER = ['Package', 'Vulnerable', 'Patched', 'Advisories'];
+export function getAuditFixChoices(advisories) {
+    if (advisories.length === 0) {
+        return [];
+    }
+    const fixable = advisories.filter(({ patched_versions: p }) => p != null);
+    if (fixable.length === 0) {
+        return [];
+    }
+    // Collapse advisories that share module_name@vulnerable_versions: they
+    // produce the same override, so showing them as separate rows would
+    // duplicate every choice. Titles are joined; the highest severity wins.
+    const deduped = dedupeByFixKey(fixable);
+    const grouped = groupBy((a) => a.severity, deduped);
+    const finalChoices = [];
+    for (const severity of SEVERITY_ORDER) {
+        const groupAdvisories = grouped[severity];
+        if (!groupAdvisories?.length)
+            continue;
+        const rows = [
+            { raw: COLUMN_HEADER, key: '', disabled: true },
+        ];
+        for (const advisory of groupAdvisories) {
+            const key = `${advisory.module_name}@${advisory.vulnerable_versions}`;
+            rows.push({
+                raw: [
+                    advisory.module_name,
+                    advisory.vulnerable_versions,
+                    advisory.patched_versions ? caretRangeForPatched(advisory.patched_versions) : '',
+                    advisory.github_advisory_id ?? '',
+                ],
+                key,
+            });
+        }
+        const rendered = alignColumns(rows.map(r => r.raw));
+        const choices = rows.map((row, i) => {
+            if (i === 0) {
+                return {
+                    name: rendered[i],
+                    value: '',
+                    disabled: true,
+                    hint: '',
+                };
+            }
+            return {
+                name: row.key,
+                message: rendered[i],
+                value: row.key,
+            };
+        });
+        finalChoices.push({
+            name: `[${severity}]`,
+            choices,
+            message: AUDIT_COLOR[severity](severity),
+        });
+    }
+    return finalChoices;
+}
+function alignColumns(rows) {
+    // No per-column width / truncate: each cell is short (package name,
+    // semver range, one or two GHSA IDs), so the table library can
+    // auto-size columns and still keep each row on a single line. Keeping
+    // rows 1:1 with rendered lines is required because the caller picks
+    // `rendered[i]` for choice `i`.
+    return table(rows, {
+        border: getBorderCharacters('void'),
+        columnDefault: {
+            paddingLeft: 0,
+            paddingRight: 2,
+        },
+        drawHorizontalLine: () => false,
+    }).split('\n').filter((line) => line.trim() !== '');
+}
+function dedupeByFixKey(advisories) {
+    const byKey = new Map();
+    for (const advisory of advisories) {
+        const key = `${advisory.module_name}@${advisory.vulnerable_versions}`;
+        const existing = byKey.get(key);
+        if (!existing) {
+            byKey.set(key, advisory);
+            continue;
+        }
+        const keepSeverity = SEVERITY_RANK[advisory.severity] > SEVERITY_RANK[existing.severity]
+            ? advisory.severity
+            : existing.severity;
+        const mergedId = existing.github_advisory_id && advisory.github_advisory_id && existing.github_advisory_id !== advisory.github_advisory_id
+            ? `${existing.github_advisory_id}, ${advisory.github_advisory_id}`
+            : existing.github_advisory_id || advisory.github_advisory_id;
+        byKey.set(key, {
+            ...existing,
+            severity: keepSeverity,
+            github_advisory_id: mergedId,
+        });
+    }
+    return Array.from(byKey.values());
+}
+//# sourceMappingURL=getAuditFixChoices.js.map

package/lib/sbom/sbom.js

@@ -3,6 +3,7 @@ import { packageManager } from '@pnpm/cli.meta';
 import { docsUrl, readProjectManifestOnly } from '@pnpm/cli.utils';
 import { types as allTypes } from '@pnpm/config.reader';
 import { WANTED_LOCKFILE } from '@pnpm/constants';
+import { isSpdxLicenseExpression, resolveLicenseFromDir } from '@pnpm/deps.compliance.license-resolver';
 import { collectSbomComponents, serializeCycloneDx, serializeSpdx, } from '@pnpm/deps.compliance.sbom';
 import { PnpmError } from '@pnpm/error';
 import { getLockfileImporterId, readWantedLockfile } from '@pnpm/lockfile.fs';
@@ -103,7 +104,14 @@ export async function handler(opts, _params = []) {
     const manifest = await readProjectManifestOnly(opts.dir);
     const rootName = manifest.name ?? 'unknown';
     const rootVersion = manifest.version ?? '0.0.0';
-    const rootLicense = typeof manifest.license === 'string' ? manifest.license : undefined;
+    // Keep the root in sync with transitive deps: consult manifest `license` /
+    // legacy `licenses` first, then fall back to an on-disk LICENSE file. Drop
+    // file-scanned values that aren't SPDX-valid to avoid non-compliant output.
+    const rootLicenseInfo = await resolveLicenseFromDir({ manifest, dir: opts.dir });
+    const rootLicense = rootLicenseInfo && rootLicenseInfo.name !== 'Unknown' &&
+        (!rootLicenseInfo.licenseFile || isSpdxLicenseExpression(rootLicenseInfo.name))
+        ? rootLicenseInfo.name
+        : undefined;
     const rootAuthor = typeof manifest.author === 'string'
         ? manifest.author
         : manifest.author?.name;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pnpm/deps.compliance.commands",
-  "version": "1101.0.0",
+  "version": "1101.1.0",
   "description": "pnpm commands for audit, licenses, and sbom",
   "keywords": [
     "pnpm",
@@ -29,32 +29,38 @@
   "dependencies": {
     "@zkochan/table": "^2.0.1",
     "chalk": "^5.6.0",
+    "enquirer": "^2.4.1",
     "memoize": "^10.2.0",
     "ramda": "npm:@pnpm/ramda@0.28.1",
     "render-help": "^2.0.0",
     "semver": "^7.7.2",
     "@pnpm/cli.command": "1100.0.0",
-    "@pnpm/cli.common-cli-options-help": "1100.0.0",
-    "@pnpm/cli.utils": "1100.0.1",
+    "@pnpm/config.writer": "1100.0.2",
+    "@pnpm/config.reader": "1101.1.0",
     "@pnpm/cli.meta": "1100.0.1",
-    "@pnpm/config.reader": "1100.0.1",
-    "@pnpm/deps.compliance.audit": "1101.0.0",
+    "@pnpm/cli.common-cli-options-help": "1100.0.0",
+    "@pnpm/deps.compliance.audit": "1101.0.1",
     "@pnpm/constants": "1100.0.0",
-    "@pnpm/deps.compliance.license-scanner": "1100.0.1",
-    "@pnpm/lockfile.fs": "1100.0.1",
-    "@pnpm/deps.compliance.sbom": "1100.0.1",
-    "@pnpm/lockfile.types": "1100.0.1",
     "@pnpm/error": "1100.0.0",
-    "@pnpm/installing.commands": "1100.0.1",
-    "@pnpm/lockfile.utils": "1100.0.1",
-    "@pnpm/lockfile.walker": "1100.0.1",
+    "@pnpm/deps.compliance.license-resolver": "1100.0.0",
+    "@pnpm/deps.compliance.license-scanner": "1100.0.3",
+    "@pnpm/cli.utils": "1101.0.0",
+    "@pnpm/installing.commands": "1100.1.1",
+    "@pnpm/lockfile.fs": "1100.0.2",
+    "@pnpm/lockfile.types": "1100.0.2",
+    "@pnpm/deps.compliance.sbom": "1100.0.3",
+    "@pnpm/lockfile.utils": "1100.0.2",
+    "@pnpm/lockfile.walker": "1100.0.2",
     "@pnpm/network.auth-header": "1100.0.1",
-    "@pnpm/workspace.project-manifest-reader": "1100.0.1",
-    "@pnpm/store.path": "1100.0.0",
-    "@pnpm/config.writer": "1100.0.1",
-    "@pnpm/types": "1101.0.0"
+    "@pnpm/types": "1101.0.0",
+    "@pnpm/workspace.project-manifest-reader": "1100.0.2",
+    "@pnpm/store.path": "1100.0.0"
+  },
+  "peerDependencies": {
+    "@pnpm/logger": ">=1001.0.0 <1002.0.0"
   },
   "devDependencies": {
+    "@jest/globals": "30.3.0",
     "@pnpm/registry-mock": "6.0.0",
     "@types/ramda": "0.31.1",
     "@types/semver": "7.7.1",
@@ -63,13 +69,14 @@
     "nock": "13.3.4",
     "read-yaml-file": "^3.0.0",
     "tempy": "3.0.0",
-    "@pnpm/deps.compliance.commands": "1101.0.0",
-    "@pnpm/pkg-manifest.reader": "1100.0.1",
-    "@pnpm/prepare": "1100.0.1",
-    "@pnpm/testing.command-defaults": "1100.0.0",
     "@pnpm/test-fixtures": "1100.0.0",
+    "@pnpm/logger": "1100.0.0",
+    "@pnpm/testing.command-defaults": "1100.0.1",
+    "@pnpm/pkg-manifest.reader": "1100.0.1",
     "@pnpm/testing.mock-agent": "1100.0.1",
-    "@pnpm/workspace.projects-filter": "1100.0.1"
+    "@pnpm/workspace.projects-filter": "1100.0.3",
+    "@pnpm/prepare": "1100.0.2",
+    "@pnpm/deps.compliance.commands": "1101.1.0"
   },
   "engines": {
     "node": ">=22.13"