You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<p>The command will exit with a 0 exit code if no vulnerabilities were found.</p>
160
161
<p>Note that some vulnerabilities cannot be fixed automatically and will
161
162
require manual intervention or review. Also note that since <code>npm audit fix</code> runs a full-fledged <code>npm install</code> under the hood, all configs that
162
-
apply to the installer will also apply to <code>npm install</code>– so things like
163
+
apply to the installer will also apply to <code>npm install</code>-- so things like
163
164
<code>npm audit fix --package-lock-only</code> will work as expected.</p>
164
165
<p>By default, the audit command will exit with a non-zero code if any
165
166
vulnerability is found. It may be useful in CI environments to include the
166
167
<code>--audit-level</code> parameter to specify the minimum vulnerability level that
167
168
will cause the command to fail. This option does not filter the report
168
-
output, it simply changes the command’s failure threshold.</p>
169
+
output, it simply changes the command's failure threshold.</p>
169
170
<h3id="audit-endpoints">Audit Endpoints</h3>
170
171
<p>There are two audit endpoints that npm may use to fetch vulnerability
171
172
information: the <code>Bulk Advisory</code> endpoint and the <code>Quick Audit</code> endpoint.</p>
module to turn a set of security advisories into a set of “vulnerability”
219
-
objects. A “meta-vulnerability” is a dependency that is vulnerable by
219
+
module to turn a set of security advisories into a set of "vulnerability"
220
+
objects. A "meta-vulnerability" is a dependency that is vulnerable by
220
221
virtue of dependence on vulnerable versions of a vulnerable package.</p>
221
222
<p>For example, if the package <code>foo</code> is vulnerable in the range <code>>=1.0.2 <2.0.0</code>, and the package <code>bar</code> depends on <code>foo@^1.1.0</code>, then that version
222
223
of <code>bar</code> can only be installed by installing a vulnerable version of <code>foo</code>.
223
-
In this case, <code>bar</code> is a “metavulnerability”.</p>
224
+
In this case, <code>bar</code> is a "metavulnerability".</p>
224
225
<p>Once metavulnerabilities for a given package are calculated, they are
225
226
cached in the <code>~/.npm</code> folder and only re-evaluated if the advisory range
226
227
changes, or a new version of the package is published (in which case, the
<divid="_table_of_contents"><ul><li><ahref="#synopsis">Synopsis</a></li><li><ahref="#description">Description</a></li><li><ahref="#details">Details</a></li><li><ahref="#a-note-about-the-caches-design">A note about the cache’s design</a></li><li><ahref="#configuration">Configuration</a></li><ul><li><ahref="#cache"><code>cache</code></a></li></ul><li><ahref="#see-also">See Also</a></li></ul></div>
145
+
<divid="_table_of_contents"><ul><li><ahref="#synopsis">Synopsis</a></li><li><ahref="#description">Description</a></li><li><ahref="#details">Details</a></li><li><ahref="#a-note-about-the-caches-design">A note about the cache's design</a></li><li><ahref="#configuration">Configuration</a></li><ul><li><ahref="#cache"><code>cache</code></a></li></ul><li><ahref="#see-also">See Also</a></li></ul></div>
0 commit comments