Skip to content

npm@7 audit version not supported

New version of npm arrived with node.js 15, it seems, that new audit.json format is not supported.

Do we plan to support new version?

Example format:

{
  "auditReportVersion": 2,
  "vulnerabilities": {
    "node-fetch": {
      "name": "node-fetch",
      "severity": "moderate",
      "via": [
        {
          "source": 124392,
          "name": "node-fetch",
          "dependency": "node-fetch",
          "title": "node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.",
          "url": "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15168",
          "severity": "moderate",
          "range": "< 2.6.1||3.0.0-beta.1 ≤ Version < 3.0.0-beta.9"
        },
        {
          "source": 1556,
          "name": "node-fetch",
          "dependency": "node-fetch",
          "title": "Denial of Service",
          "url": "https://npmjs.com/advisories/1556",
          "severity": "low",
          "range": "< 2.6.1 || >= 3.0.0-beta.1 < 3.0.0-beta.9"
        }
      ],
      "effects": [],
      "range": "<=2.6.0 || 3.0.0-beta.1 - 3.0.0-beta.8",
      "nodes": [
        "node_modules/node-fetch"
      ],
      "fixAvailable": true
    }
  },
  "metadata": {
    "vulnerabilities": {
      "info": 0,
      "low": 0,
      "moderate": 1,
      "high": 0,
      "critical": 0,
      "total": 1
    },
    "dependencies": {
      "prod": 104,
      "dev": 88,
      "optional": 0,
      "peer": 0,
      "peerOptional": 0,
      "total": 192
    }
  }
}
Edited by Honza Machala