Closed
Description
In npm 6 npm install
was unaffected by the audit-level
config setting. It only affected the exit code of npm audit
itself. In npm 7 this behavior has been carried over to npm install
.
Current Behavior:
If I set audit-level
then npm install
exits uncleanly if there are vulnerabilities found during install that match that level or higher.
Expected Behavior:
The exit status of npm install
should be unaffected by the audit-level
setting.
Steps To Reproduce:
Make a new package that depends on "minimist": "~1.1.3"
.
-
npm install
passes in both npm 6 and npm 7. -
npm audit
fails in both npm 6 and npm 7. -
NPM_CONFIG_AUDIT_LEVEL=low npm install
passes in npm 6, but fails in npm 7. -
NPM_CONFIG_AUDIT_LEVEL=low npm audit
fails in npm 6 and npm 7.
Environment:
- npm: v6.14.11 and v7.5.4