npmpackage.info

Gathering detailed insights and metrics for lerna-audit

lerna-audit

Micro util to run npm audit in lerna monorepos

1.3.3

JavaScript

31.38 kB

2,421,468 2.4

Installations

npm install lerna-audit

Pull Requests

Open

5

Total

28

Closed

4

Merged

19

Issues

Open

5

Total

12

Closed

7

Releases

v1.3.3

Published on 13 Sept 2021

v1.3.2

Published on 02 Apr 2021

v1.3.1

Published on 04 Mar 2021

v1.3.0

Published on 10 Nov 2020

View all 4 releases

Developer

tnobody

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

Typescript Support

No

Node Version

12.22.6

NPM Version

6.14.15 Statistics

9 Stars

97 Commits

11 Forks

3 Watching

8 Branches

7 Contributors

Updated on 05 Aug 2022

Bundle Size

100.02 kB

Minified

31.38 kB

Minified + Gzipped

Bundlephobia

Languages

JavaScript (100%)

Total Downloads

Cumulative downloads

Total Downloads

2,421,468

Last day

3.7%

2,112

Compared to previous day

Last week

-6%

12,437

Compared to previous week

Last month

7.5%

56,576

Compared to previous month

Last year

-1.7%

697,634

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

yargs

Dev Dependencies

jest

Versions

Lerna Audit

Micro util to run npm audit for lerna packages (with autofix).

How to use

Install

In the root of your lerna monorepo run:

npm i lerna-audit -D

yarn add lerna-audit -D

Use

In the root of your lerna monorepo run:

npx lerna-audit [OPTIONS]

Or add a script to your package.json in root:

1{
2  "scripts": {
3    "audit": "lerna-audit"
4  }
5}

Options

Parameter	Default	Description
`--no-fix`	false	(optional) Do not fix the found vulnerabilities, just audit

Why

Lerna works in a way that it manages "internal" dependencies within your monorepo by managing all relevant npm link commands for you in local development. So you can keep the dependencies to other packages in the monorepo in your package.json while linking the latest versions during development. The downside is that all commands that depend on the dependencies defined in package.jsons will fail because "internal" packages are just linked and not yet published. One of this commands is npm audit because it tires to analyse the dependency tree. lerna-audit mimics the behavior of lerna - removing internal packages from package.json, run the command, restore package.json - to run a npm fix in every lerna managed package.

No vulnerabilities found.

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

2

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Maintained

Determines if the project is "actively maintained".

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

License

Determines if the project has defined a license.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

SAST

Determines if the project uses static code analysis.

0

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

Score

2.4

/10

Last Scanned on 2024-11-18

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More