Get unlimited public & private packages + package-based permissions with npm Pro.Get started »

This package has been deprecated

Author message:

Moved to https://www.npmjs.com/package/jest-package-audit

@xerox/jest-package-audit

2.0.5 • Public • Published

jest-package-audit

Filter and retry yarn/npm audit command with Jest.

circleci status npm package license MIT commit style angular semantic-release tested with jest Dependabot Status

The yarn audit, and npm audit commands are useful for detecting packages in use that have vulnerabilites. But they don't allow filtering. For example you may have a vulnerability in a package you are only using in development, and the nature of that vulnerability is more often than not only unsafe when used in production. Updating the dependency to fix the vulnerability may break things. That is where jest-package-audit comes in, it wraps the yarn audit and npm audit commands and checks each vulnerabilty they flag against an array of allowed vulnerability names e.g. ['puppeteer'].

Another added benefit of jest-package-audit is the ability to retry tests if they fail. This is useful as the audit endpoints can sometimes timeout out or randomly give 503 HTTP Status codes back. Using jest.retryTimes you can overcome this by retrying say 5 times.

Usage

Important: jest-package-audit only works with Jest >= 23 as it depends on async matchers.

  1. Install jest-package-audit:
yarn add @xerox/jest-package-audit --dev
# or 
npm install @xerox/jest-package-audit --save-dev
  1. Create a new test file for package auditing:
// audit.test.js
import { toPassPackageAudit } from '@xerox/jest-package-audit';
expect.extend({ toPassPackageAudit });
 
jest.retryTimes(5); // Optional
jest.setTimeout(15000); // The audit command can take a while...
 
test('packages do not have vunerabilities', async () => {
  await expect({/* Input options */}).toPassPackageAudit({ allow: ['puppeteer'] /* Output options */ });
});

Options

Input Options

Input options should be passed to the expect function when using toPassPackageAudit, they define how the actual yarn audit or npm audit command is run.

Name Description Default
cwd: (String) Current working directory to run the audit command in. The closest folder with a package.json above jest-package-audit.
command (String) Which command to run, e.g. yarn audit or npm audit you can also pass additional options for these commands. yarn audit

Output Options

Output options should be passed to the toPassPackageAudit function, they define how the output of yarn audit or npm audit is processed.

Name Description Default
accept: (String[]) An array of package names to allow if they have vulnerabilities. []

Disclaimer

Please be aware that we provide no liability for any security issues, or any other issues for that matter, encountered when using this package. It is provided as open-source software under the MIT license. So please read the source code and make sure you understand the implications of allowing vulnerable modules to pass through the audit commands!


LICENSE | CHANGELOG | ISSUES

Install

npm i @xerox/jest-package-audit

DownloadsWeekly Downloads

31

Version

2.0.5

License

MIT

Unpacked Size

38.7 kB

Total Files

18

Last publish

Collaborators

  • avatar
  • avatar
  • avatar