[Feature] `yarn npm audit --fix`

[jdanil]

• [x] I'd be willing to implement this feature (contributing guide)
• [ ] This feature is important to have in this repository; a contrib plugin wouldn't do

Describe the user story

As a developer, when yarn npm audit reports vulnerabilities, I would like to be able to remediate them if compatible patched versions exist.

Currently, to resolve vulnerabilities I either need to...

• add a resolution for the transitive dependency, run yarn install, remove the resolution, run yarn install again,
• regenerate my lockfile, or
• run yarn up --recursive on each vulnerable package.

Describe the solution you'd like

I would like to propose adding a --fix option to yarn npm audit. Now that yarn up supports a --recursive option (introduced in #2427) I think it should be fairly easy to iterate over the advisories and run yarn up <name> --recursive for each advisory, to attempt to update any dependencies that were reported as vulnerable to their latest compatible versions.

Describe the drawbacks of your solution

What I'm not 100% sure about yet is how we would update the audit results. After running yarn up --recursive, would we then try to find the installed versions of the dependency and then use a semver util to see if it matches a patched version, and if it does, remove the advisory from the results? The results from the audit endpoint may need to be coerced a bit to perform this comparison as they aren't always valid semver ranges (e.g. >1.0.0 <2.0.0).

Another alternative I considered is to simply trigger a new request for an audit report and let the server figure out what vulnerabilities remain.

Describe alternatives you've considered

I think this could be delivered by a plugin, as yarn npm audit --json provides the full report from the server. But I think with the new changes to yarn up it could be supported with very minimal code changes to yarn.

[mxro]

Would this package cover this requirement: yarn-audit-fix?

[sargunv]

I've recently written a plugin for this: https://github.com/sargunv/yarn-plugin-npm-audit-fix.

If maintainers are interesting in getting this implementation into Yarn itself, I'd be happy to start a PR.