search

renovatebot / app-support

Discussion/support issues for the hosted Renovate App
0 stars 0 forks source link

npm audit fix #82

Closed broksonic21 closed 4 years ago

broksonic21 commented 4 years ago

With npm turned on, we see our package.json get bumped, but that often still leaves npm audit warnings in the package-lock.json

Is there a way to get the equivalent of npm audit fix to automatically run?

or is that because we don't have package-lock.json listed here in includePaths?

"automerge": true, "rangeStrategy": "bump", "enabledManagers": ["npm"], "includePaths": ["package.json"],

rarkins commented 4 years ago

Sorry, that's not functionality we support, although if running on GitHub then we do attempt to reuse their vulnerability alerts. Adding package-lock.json won't work, and actually your includePaths isn't necessary either.