search

IBM / audit-ci

Audit NPM, Yarn, PNPM, and Bun dependencies in continuous integration environments, preventing integration if vulnerabilities are found at or above a configurable threshold while ignoring allowlisted advisories
Apache License 2.0
264 stars 42 forks source link

v7 ignores command line arguments #334

Closed hwo411 closed 3 months ago

hwo411 commented 3 months ago

After updating to v7 command line arguments are ignored

e.g.,

npx audit-ci@^7 --help audit-ci --help

and any others perform scan and return results, e.g.

Yarn audit report results:
{
  "vulnerabilities": {
    "info": 0,
    "low": 0,
    "moderate": 2,
    "high": 2,
    "critical": 0
  },
  "dependencies": 1666,
  "devDependencies": 0,
  "optionalDependencies": 0,
  "totalDependencies": 1666
}

That happen with any argument, e.g., including config.

OS: MacOS 14.5 @ ARM Node: v18.19.1

That also happens inside docker images.

Version 6 works properly on the same machine.

quinnturner commented 3 months ago

Confirmed reproduction, working on it.

quinnturner commented 3 months ago

335 fixes this issue. Thank you for reporting. We haven't had coverage on the command line parser; we should add that. I've released v7.0.1 with this fix and highlighted in our release notes to skip v7.0.0.