fix(audit): query the npm bulk advisory endpoint directly - #32
Open
littledino2112 wants to merge 1 commit into
Open
fix(audit): query the npm bulk advisory endpoint directly#32littledino2112 wants to merge 1 commit into
littledino2112 wants to merge 1 commit into
Conversation
npmjs.org retired the legacy audit endpoints on 2026-07-15 (410 Gone), breaking 'yarn audit' permanently (Yarn v1 is frozen) and 'pnpm audit' for every release before pnpm 11. Since then nodejs-audit has passed vacuously: the audit command exits 1 on the 410, which the exit-code bitmask check reads as no findings. audit-advisories.js reads the package set straight from the lockfile (pnpm-lock.yaml v6/v9 or yarn.lock v1) and posts it to the documented replacement endpoint /-/npm/v1/security/advisories/bulk - the same request pnpm 11 sends - applying the same severity threshold. The Concourse task and the synced GitHub action both delegate to it; the action no longer needs pnpm or an install step.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
npmjs retired the legacy audit endpoints on 2026-07-15 (410 Gone), which kills
yarn auditpermanently (Yarn v1 is frozen) andpnpm auditbefore pnpm 11. Worse,nodejs-audit.shhas been passing vacuously since then: the audit command exits 1 on the 410, and the exit-code bitmask check reads that as "no findings".The new
audit-advisories.js(node stdlib, no dependencies) reads the package set straight from the lockfile — pnpm-lock.yaml v6 and v9, and yarn.lock v1 are all supported — and POSTs it to the documented replacement endpoint, the same request shape pnpm 11 itself sends (pnpm#11268). Same severity threshold semantics; registry unavailability still passes the gate (parity with the old behavior). The Concourse task and the synced GitHub action both delegate to it — the action no longer needs pnpm or an install step. Mirrors the buck2-side fix in blinkbitcoin/blink#685.Rollout warning — expect red gates, and that's the point: real findings accrued while audits were vacuous. Tested against current lockfiles at
high: blink 78 findings, price 52 + one critical (@babel/traverseRCE, GHSA-67hx-6x53-jw92, vulnerable since 2023), blink-terminal 26. Repos re-syncing this at the defaultlevel=highwill fail until triaged — instantiatingnodejs_audit(level="critical")during triage is the escape valve. Consumers using the synced action needci/vendor/tasks/in their vendir config (blink-kyc, blink-terminal, blink-fiat, admin-panel already have it).