pnpm-audit

Check pnpm dependencies for vulnerabilities

TLDR

Run security audit

$ pnpm audit

Fix vulnerabilities

$ pnpm audit --fix

JSON output

$ pnpm audit --json

Audit production only

$ pnpm audit --prod

pnpm audit scans project dependencies for known security vulnerabilities using the npm advisory database. It reports affected packages, severity levels, and available patched versions.The --fix option attempts to automatically update vulnerable packages to safe versions. Use --prod or --dev to limit scanning to production or development dependencies respectively. The --audit-level option sets the minimum severity threshold for reporting (low, moderate, high, critical).

PARAMETERS

--fix

Add overrides to package.json that pin vulnerable transitive dependencies to safe versions.

--json

Output the audit report as JSON.

-P, --prod

Audit only production dependencies (skip devDependencies).

-D, --dev

Audit only development dependencies.

--no-optional

Skip optional dependencies during the audit.

--audit-level LEVEL

Minimum severity to report: low, moderate, high, or critical (default: low).

--ignore CVE

Suppress reporting for a specific advisory by its identifier.

--ignore-unfixable

Skip advisories that have no available patch.

--ignore-registry-errors

Exit with code 0 when the registry returns a non-200 status, only failing if real vulnerabilities are found.

INSTALL

sudo dnf install pnpm

sudo pacman -S pnpm

sudo apk add pnpm

sudo zypper install pnpm

brew install pnpm

nix profile install nixpkgs#pnpm

CAVEATS

Requires network access. Uses npm advisory database.

HISTORY

pnpm audit was added for security vulnerability scanning in dependencies.