audit-ci

Audit NPM, Yarn, PNPM, and Bun dependencies in continuous integration environments, preventing integration if vulnerabilities are found at or above a configurable threshold while ignoring allowlisted advisories

APACHE-2.0 License

Downloads
746.7K
Stars
264
Committers
24

Bot releases are hidden (Show)

audit-ci - Warn when whitelisted advisories are not found + bug fixes

Published by quinnturner over 5 years ago

Diff: https://github.com/IBM/audit-ci/compare/v1.5.0..v1.6.0

Features

  • Warn when whitelisted advisories are not found (closes #70) (PR: #73)

Fixes

  • Handle non-JSON Yarn audit report (re-closes #45) (PR: #66 and #76)
  • Fix broken link in README (PR: #78)

Chores

  • Update .travis.yml config to use the cache: npm shortcut and provide more docs (PR: #79)
  • Fix advisories (fixes #67) (PR: #68 and #80)
  • Bump Mocha (minor) (PR: #80)
  • Bump ESLint (minor) (PR: #80)

Minor release due to the new behaviour of Yarn non-JSON audit report and warning when whitelisted advisories are not found

audit-ci - Handle non-JSON Yarn audit report and address advisory 788

Published by quinnturner over 5 years ago

Diff: https://github.com/IBM/audit-ci/compare/v1.4.1..v1.5.0

Fixes

  • Handle non-JSON Yarn audit report (closes #45) (PR: #66)

Chores

  • Address advisories (closes #67) (PR: #68)
  • Bump Semver (major) (PR: #68)
  • Bump eslint (patch) (PR: #68)

Minor release due to the new behaviour of Yarn non-JSON audit report

audit-ci - Add `--registry` argument + lint fixes

Published by quinnturner over 5 years ago

Diff: https://github.com/IBM/audit-ci/compare/v1.4.0..v1.4.1

Features

  • Add --registry argument (closes #46) (PR: #47)

Fixes

  • Add test directory to npm run lint (PR: #62)

Chores

  • Line-ending-related clean up (PR: #62)
  • Bump ESLint (minor) (PR: #62)
  • Bump eslint-config-prettier (patch) (PR: #62)
audit-ci - Unit testing - directory argument - summary reporting

Published by quinnturner over 5 years ago

Diff: https://github.com/IBM/audit-ci/compare/v1.3.1..v1.4.0

BREAKING CHANGES

  • The new default output is the summary report rather than the full report.

Features

  • Unit testing (closes #4) (PR: #53, #54)
  • Add --directory argument (closes #17) (PR: #53, #56)
  • Add option to output summary report (closes #58) (PR: #59)

Chores

  • Use spawn rather than exec for NPM (closes #48) (PR: #53)
  • Bump ESLint (minor)
audit-ci - Error handling improvements and updated dependencies

Published by quinnturner over 5 years ago

Changes made for this release: https://github.com/IBM/audit-ci/compare/v1.3.0..v1.3.1

Bug fixes

ee86366d1c310ffeebb414d9150e7cf63856f5f1 - Replace error checking from stderr to error #50

Chores

982f494a5fe3c38962a1867f3b1da241daa014e1 - Update dependencies #51

audit-ci - Config file support

Published by quinnturner almost 6 years ago

Changes made for this release: https://github.com/IBM/audit-ci/compare/v1.2.1..v1.3.0

Features:
39c3c87e - feat(config-file): Add support for reading a config file (#43)

Bug fixes:
654f51bd - fix(package.json): Change homepage and bugs url split char from : to / (#41)

audit-ci - Whitelist advisories and Yarn fix

Published by quinnturner almost 6 years ago

Changes made for this release: https://github.com/IBM/audit-ci/compare/v1.2.0..v1.2.1

Features:
beb57e67 - feat(advisory): Whitelist advisories (#38)

Bug fixes:
929b75c3 - Fix Yarn output parsing (#36)
e64f4b55 - fix(homepage): Added missing slash to homepage url.

audit-ci - Yarn Support

Published by quinnturner almost 6 years ago

Changes made for this release: https://github.com/IBM/audit-ci/compare/v1.1.0..v1.2.0

Features

  • Yarn support
  • Prettier styling with husky git hooks

Bug fixes

  • Improved error uncaught exception error handling by displaying the stack trace rather than saying an unknown error occurred

No known breaking changes.

audit-ci - Project restructuring

Published by quinnturner almost 6 years ago

Changes made for this release: https://github.com/IBM/audit-ci/compare/v1.0.2..v1.1.0

Changes

  • Recommend installing as a devDepenency instead of a global dependency at CI-time to speed up cached builds and reduce risk of inconsistency
  • Separated yargs code and the auditing. This will support testing.
  • Removed babel as a dependency to reduce overhead.
  • NPM package uses lib folder instead of index.js.
  • bin/audit-ci references lib/audit-ci.js
  • Audit rejections return Error. Audit passes return the report.
  • Use console.log and console.error instead of process.stdout.write
  • Added colour to output where appropriate.
  • Added lint test for Travis-CI and CircleCI.

Commits

c3a3f73 - chore: Update README to prefer devDependency installation.
2bb1ef0 - chore: Updated Travis-CI and CircleCI config documentation
147ed78 - feat(restructure): Project restructuring and improvements. (PR #15)

audit-ci - Address issue bin/audit-ci line-break in Linux environment

Published by quinnturner almost 6 years ago

Changes made for this release: https://github.com/IBM/audit-ci/compare/v1.0.1..v1.0.2

  • Packaged in a Linux environment to address: https://github.com/IBM/audit-ci/issues/13. Did not come up with a long-term solution to this, so for now will not package on Windows.
  • Cache the Travis-CI build for quicker builds
  • Updated README to suggest integrating as a dev-dependency
audit-ci - Dependency updates

Published by quinnturner almost 6 years ago

Changes made for this release: https://github.com/IBM/audit-ci/compare/v1.0.0..v1.0.1

  • @babel/cli: ^7.1.2 --> ^7.1.5
  • @babel/core; ^7.1.2 --> ^7.1.6
  • @babel/preset-env: ^7.1.0 --> ^7.1.6
  • eslint: ^5.3.0 --> ^5.9.0

Removed babel-core

audit-ci - Initial release

Published by quinnturner almost 6 years ago