From d3ad3368f18ba156018021ed4e591faf3263f0e8 Mon Sep 17 00:00:00 2001 From: Zoltan Kochan Date: Tue, 28 Jun 2022 02:34:37 +0300 Subject: [PATCH] fix: audit fix should not add an override for a vulnerability that has no fix --- .changeset/healthy-masks-rescue.md | 6 ++++++ packages/plugin-commands-audit/src/fix.ts | 2 +- 2 files changed, 7 insertions(+), 1 deletion(-) create mode 100644 .changeset/healthy-masks-rescue.md diff --git a/.changeset/healthy-masks-rescue.md b/.changeset/healthy-masks-rescue.md new file mode 100644 index 0000000000..d57339b316 --- /dev/null +++ b/.changeset/healthy-masks-rescue.md @@ -0,0 +1,6 @@ +--- +"@pnpm/plugin-commands-audit": patch +"pnpm": patch +--- + +`pnpm audit --fix` should not add an override for a vulnerable package that has no fixes released. diff --git a/packages/plugin-commands-audit/src/fix.ts b/packages/plugin-commands-audit/src/fix.ts index 53a42bcf39..e5ec978dac 100644 --- a/packages/plugin-commands-audit/src/fix.ts +++ b/packages/plugin-commands-audit/src/fix.ts @@ -22,7 +22,7 @@ export default async function fix (dir: string, auditReport: AuditReport) { function createOverrides (advisories: AuditAdvisory[]) { return fromPairs( advisories - .filter(({ vulnerable_versions }) => vulnerable_versions !== '>=0.0.0') // eslint-disable-line + .filter(({ vulnerable_versions, patched_versions }) => vulnerable_versions !== '>=0.0.0' && patched_versions !== '<0.0.0') // eslint-disable-line .map((advisory) => [ `${advisory.module_name}@${advisory.vulnerable_versions}`, advisory.patched_versions,