Releases: G-Rath/audit-app
v0.8.1
0.8.1 (2022-07-27)
This version updates the json schema for config files to allow GHSA IDs.
Note that while audit-app is not officially deprecated, we now strongly
recommend using osv-detector instead - it does the exact same thing,
only better! (and faster too)
- update schema to allow GHSA IDs (#22)
v0.8.0
0.8.0 (2022-03-14)
This version changes audit findings to use the GHSA as the ID where possible,
which means existing ignores will be incorrect now - luckily this release also
adds a --update-config-ignores flag which can be used to automatically update
the ignore field in the config with all the vulnerabilities found by the
auditor!
The reason for this change is that the IDs have not been stable since the NPM
advisory was merged into the GitHub advisory database, so CIs often fail due to
ignores being "missing" and "new" vulnerabilities appearing.
This should resolve that, since the GHSA should be stable and present for all
findings with all package managers.
v0.7.0
This release greatly improves NPM 7 support, including restoring dependency
paths used for ignoring vulnerabilities to their full selves as they are with
yarn and NPM 6.
This also means workspaces (which are new in NPM 7) and file: dependencies are
supported properly - there are a few quirks, but these exist in NPM as well and
are a nature of using local file dependencies so cannot be easily avoided.
All vulnerabilities should be reported, but nested file: dependencies may be
listed both as nested & again as top-level dependencies.
v0.6.0
v0.5.3
v0.5.2
v0.5.1
v0.5.0
This release dramatically changes the audit report created by audit-app in
order to support NPM 7.
In addition to changing the JSON structure outputted by --output json, the
format of ignore paths has also changed meaning any existing ignores will need
to be updated.