mirror/pnpm
1
0
Fork 0
mirror of https://github.com/pnpm/pnpm.git synced 2026-07-26 07:27:20 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix: audit fix should not add an override for a vulnerability that has no fix

Browse Source
This commit is contained in:
Zoltan Kochan
2022-06-28 02:34:37 +03:00
parent 00c12fa53d
commit d3ad3368f1
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
.changeset/healthy-masks-rescue.md Normal file
View File

@@ -0,0 +1,6 @@
---
"@pnpm/plugin-commands-audit": patch
"pnpm": patch
---
`pnpm audit --fix` should not add an override for a vulnerable package that has no fixes released.

2
packages/plugin-commands-audit/src/fix.ts
View File

@@ -22,7 +22,7 @@ export default async function fix (dir: string, auditReport: AuditReport) {
function createOverrides (advisories: AuditAdvisory[]) {
return fromPairs(
advisories
.filter(({ vulnerable_versions }) => vulnerable_versions !== '>=0.0.0') // eslint-disable-line
.filter(({ vulnerable_versions, patched_versions }) => vulnerable_versions !== '>=0.0.0' && patched_versions !== '<0.0.0') // eslint-disable-line
.map((advisory) => [
`${advisory.module_name}@${advisory.vulnerable_versions}`,
advisory.patched_versions,