Scan for vulnerabilities on all dependencies recursively #6
Assignees
Comments
st3phhays
added a commit
to st3phhays/choco-astro
that referenced
this issue
Sep 24, 2024
This updates the yarn npm audit command to include all severity types and scan dependencies recursively.
This was referenced Sep 25, 2024
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Checklist
Is Your Feature Request Related To A Problem? Please describe.
Right now, in the
audit.yamlfile, we are runningyarn npm audit --severity moderate, however, this does not seem to scan enough dependencies to catch everything that might be reported by Dependabot.Describe The Solution. Why is it needed?
We should instead change the command to:
yarn npm audit --all --recursiveto ensure that all dependencies are audited recursively. This will ensure that we catch all vulnerabilities before shipping.Additional Context
No response
Related Issues
No response
The text was updated successfully, but these errors were encountered: