Yarn classic's `audit` does not appear to support aliases

Question

gabidobo opened this issue 2 years ago · comments

Notice the fracture in the vulnerability path below:

@pnpm/lockfile-file has a dependency on @zkochan/js-yaml, so the latest version (0.0.6) is installed. This dependency is aliased as js-yaml.
When running yarn audit the alias is ignored by Yarn, and we get back vulnerabilites for js-yaml@0.0.6 instead. That specific package version is not actually installed.
We do, however, have js-yaml@3.14.1 installed as a dependency for @yarnpkg/parsers. That node gets wrongly labeled as a vulnerability, and looks disconnected from his path.
Reproduce by running yarn audit in this repo's root.

github-actions · Answer 1 · Sat Mar 25 2023 10:17:56 GMT+0800 (China Standard Time)

This issue is stale because it has been open for 30 days with no activity.

github-actions · Answer 2 · Sun Apr 09 2023 10:16:38 GMT+0800 (China Standard Time)

This issue was closed because it has been inactive for 14 days since being marked as stale.