Closed wingleung closed 6 years ago
No; if npm audit
fails without a lockfile, then npm audit
is broken.
The proper fix here is to add audit=false
to .npmrc
, until npm fixes the issue with npm audit
.
ahh, i see that npm audit
fails but npm install
doesn't.
This is a non-problem; npm audit
isn't really necessary.
@ljharb should we disable npm audit? package-lock.json is never available so npm audit
will (temporarily?) not work.
On npm install
there is a small report that some dependencies are vulnerable but it doesn't say which. To know which ones, we should use npm audit
, resulting in the EAUDITNOLOCK
error message. Is this useful?
...
[!] 7 vulnerabilities found [3729 packages audited]
Severity: 5 low | 2 critical
Run `npm audit` for more detail
branch is ready if need be -> https://github.com/wingleung/hypernova/commit/8310d1d37e4b81a8e7bac9c21df3fa1359040174
npm install
within the hypernova repo on npm@6 keeps failing.Steps to reproduce
npm install
npm audit
npm i --package-lock-only
installs all the packages but doesn't create a package-lock.json because the .npmrc has package-lock disabled.