Скачать или смотреть How to Effectively Use npm audit with NPM Workspaces

Discover how to utilize `npm audit` in your NPM workspaces, ensuring your project remains secure and free from vulnerabilities.
---
This video is based on the question https://stackoverflow.com/q/74960260/ asked by the user 'TimeWasterNL' ( https://stackoverflow.com/u/10025881/ ) and on the answer https://stackoverflow.com/a/74984299/ provided by the user 'TimeWasterNL' ( https://stackoverflow.com/u/10025881/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: How to use npm audit with NPM workspaces?

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
How to Effectively Use npm audit with NPM Workspaces

When managing JavaScript projects, especially those that involve multiple packages, ensuring security through dependency management is vital. One of the tools available for this is npm audit, which checks your project for vulnerabilities. However, when working with NPM workspaces, many users face challenges in getting npm audit to function correctly across all workspaces. In this post, we will explore the problem and how to effectively run npm audit in a project that utilizes NPM workspaces.

The Problem with npm audit in NPM Workspaces

If you're transitioning your project to use NPM workspaces (like from lerna), you might find that running npm audit at the root level of your project doesn't take the vulnerabilities from your workspaces into account.

Example Project Structure

Consider the following folder structure for a project utilizing workspaces:

[[See Video to Reveal this Text or Code Snippet]]

Symptoms of the Issue:

When vulnerabilities are present in the root package.json, npm audit collects the reports as expected.

However, if a vulnerability is added to the workspace-a package, it goes unnoticed by npm audit, which will report zero vulnerabilities despite the presence of issues.

Attempts to Resolve the Issue

Initially, various commands were attempted, such as:

npm audit --workspaces=true

npm audit --workspace lib/lambdas/workspace-a

npm audit --package-lock-only

Unfortunately, these efforts did not yield fruitful results.

The Solution

Through investigation and hands-on testing, the solution to this problem became clear. It mainly revolves around the configuration of your .npmrc file.

Key Findings

Registry Configuration:

The issue may arise from the registry settings in your .npmrc file.

By commenting out any enterprise npm repository configuration, you may find that npm audit starts picking up vulnerabilities again.

Alternative Command:

If you do not want to alter your global configuration, you can run npm audit directly with a specified registry:

[[See Video to Reveal this Text or Code Snippet]]

Important Notes

The issue with registry settings appears to affect only audits on workspaces and nested dependencies. Top-level dependencies from the root package.json will be audited without any additional configurations.

Conclusion

NPM workspaces simplify managing multi-package repositories, but they sometimes come with challenges regarding audit tools like npm audit. By understanding how registry configurations in .npmrc impact the audit process, you can ensure that your entire project is securely maintained against vulnerabilities. Implement the solution shared above, and enjoy a more secure development workflow.

Remember, keeping your dependencies up to date and running regular audits is essential in maintaining the security of your applications. Happy coding!