Skip to content

npm 7 with audit-level set fails the install when audit warnings exist #2715

Closed
@ljharb

Description

@ljharb

In npm 6 npm install was unaffected by the audit-level config setting. It only affected the exit code of npm audit itself. In npm 7 this behavior has been carried over to npm install.

Current Behavior:

If I set audit-level then npm install exits uncleanly if there are vulnerabilities found during install that match that level or higher.

Expected Behavior:

The exit status of npm install should be unaffected by the audit-level setting.

Steps To Reproduce:

Make a new package that depends on "minimist": "~1.1.3".

  • npm install passes in both npm 6 and npm 7.

  • npm audit fails in both npm 6 and npm 7.

  • NPM_CONFIG_AUDIT_LEVEL=low npm install passes in npm 6, but fails in npm 7.

  • NPM_CONFIG_AUDIT_LEVEL=low npm audit fails in npm 6 and npm 7.

Environment:

  • npm: v6.14.11 and v7.5.4

Metadata

Metadata

Assignees

No one assigned

    Labels

    Bugthing that needs fixingNeeds Discussionis pending a discussionPriority 2secondary priority issueRelease 7.xwork is associated with a specific npm 7 release

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions