Skip to main content
Version: Next

pnpm audit

检查已安装软件包的已知安全问题。

🌐 Checks for known security issues with the installed packages.

如果发现安全问题，请尝试通过 pnpm update 更新你的依赖。如果简单更新不能解决所有问题，请使用 overrides 强制使用不易受攻击的版本。例如，如果 lodash@<2.1.0 存在漏洞，请使用此 overrides 强制使用 lodash@^2.1.0：

🌐 If security issues are found, try to update your dependencies via pnpm update. If a simple update does not fix all the issues, use overrides to force versions that are not vulnerable. For instance, if lodash@<2.1.0 is vulnerable, use this overrides to force lodash@^2.1.0:

pnpm-workspace.yaml
overrides:
  "lodash@<2.1.0": "^2.1.0"

或者，运行 pnpm audit --fix。

🌐 Or alternatively, run pnpm audit --fix.

如果你想容忍某些漏洞，因为它们不会影响你的项目，你可以使用 auditConfig.ignoreGhsas 设置。

🌐 If you want to tolerate some vulnerabilities as they don't affect your project, you may use the auditConfig.ignoreGhsas setting.

自 v11 起，pnpm audit 查询注册表的 /-/npm/v1/security/advisories/bulk 端点。响应不包含 CVE 标识符，因此建议通过 GitHub Advisory ID（GHSA）进行筛选。如果你之前在 auditConfig.ignoreCves 下列出了 CVE，请将每条条目替换为对应的 GHSA-xxxx-xxxx-xxxx 值（显示在 pnpm audit 输出的 More info 列中）下的 auditConfig.ignoreGhsas。

🌐 Since v11, pnpm audit queries the registry's /-/npm/v1/security/advisories/bulk endpoint. The response does not include CVE identifiers, so advisories are filtered by GitHub advisory ID (GHSA) instead. If you previously listed CVEs under auditConfig.ignoreCves, replace each entry with the corresponding GHSA-xxxx-xxxx-xxxx value (shown in the More info column of pnpm audit output) under auditConfig.ignoreGhsas.

命令​

🌐 Commands

signatures​

新增于：v11.1.0

🌐 Added in: v11.1.0

pnpm audit signatures

根据每个注册表在 /-/npm/v1/keys 发布的公钥，验证已安装包的 ECDSA 注册表签名。通过 registries 配置的作用域注册表将被尊重；未发布签名密钥的注册表将被跳过。

🌐 Verifies the ECDSA registry signatures of installed packages against the public keys published by each registry at /-/npm/v1/keys. Scoped registries configured via registries are respected; registries that don't publish signing keys are skipped.

如果任何软件包具有无效签名，或者注册表宣告签名密钥但某个软件包是在没有签名的情况下发布的，则该命令以代码 1 退出。与 --json 结合使用可以获得机器可读的输出。

🌐 The command exits with code 1 if any package has an invalid signature, or if a registry advertises signing keys but a package was published without a signature. Combine with --json to get machine-readable output.

选项​

🌐 Options

--audit-level <severity>​

  • 类型：低、中、高、严重
  • 默认：低

仅打印严重性大于或等于 <severity> 的通知。

🌐 Only print advisories with severity greater than or equal to <severity>.

这也可以通过在 pnpm-workspace.yaml 中设置 auditLevel 来实现。

🌐 This can also be set via auditLevel in pnpm-workspace.yaml.

--fix​

在 pnpm-workspace.yaml 文件中添加覆盖以强制使用无漏洞的依赖版本。

🌐 Add overrides to the pnpm-workspace.yaml file in order to force non-vulnerable versions of the dependencies.

使用 --fix=update（在 v11.0.0 中添加）通过更新锁文件中的包来修复漏洞，而不是添加覆盖。

🌐 Use --fix=update (added in v11.0.0) to fix vulnerabilities by updating packages in the lockfile instead of adding overrides.

当minimumReleaseAge 被设置时，--fix 也会将每个通告的最低修补版本添加到 pnpm-workspace.yaml 中的minimumReleaseAgeExclude，这样可以在不等待发布年龄窗口的情况下安装安全修复。

🌐 When minimumReleaseAge is set, --fix also adds the minimum patched version of each advisory to minimumReleaseAgeExclude in pnpm-workspace.yaml, so the security fix can be installed without waiting for the release age window.

--interactive, -i​

新增于：v11.0.0

🌐 Added in: v11.0.0

审查由 --fix 选择的建议，并挑选要应用的内容。只能与 --fix 一起使用。

🌐 Review the advisories selected by --fix and pick which ones to apply. Only usable together with --fix.

--json​

以 JSON 格式输出审计报告。

🌐 Output audit report in JSON format.

--dev, -D​

仅审核开发依赖。

🌐 Only audit dev dependencies.

--prod, -P​

仅审核生产依赖。

🌐 Only audit production dependencies.

--no-optional​

不要审核 optionalDependencies。

🌐 Don't audit optionalDependencies.

--ignore-registry-errors​

如果注册表返回非 200 状态码，进程应以 0 退出。 所以只有当注册表实际上成功返回发现的漏洞时，进程才会失败。

🌐 If the registry responds with a non-200 status code, the process should exit with 0. So the process will fail only if the registry actually successfully responds with found vulnerabilities.

--ignore-unfixable​

新增于：v10.11.0

🌐 Added in: v10.11.0

忽略所有没有解决方案的建议。

🌐 Ignore all advisories with no resolution.

自 v11 起，无法修复的安全警告由 GHSA 而非 CVE 跟踪。

🌐 Since v11, unfixable advisories are tracked by GHSA rather than CVE.

--ignore <vulnerability>​

新增于：v10.11.0

🌐 Added in: v10.11.0

通过其 GitHub Advisory ID (GHSA) 忽略一个漏洞。在 v11 之前，此标志接受 CVE 标识符。

🌐 Ignore a vulnerability by its GitHub advisory ID (GHSA). Before v11 this flag accepted CVE identifiers.

配置​

🌐 Configuration

auditConfig​

auditConfig.ignoreGhsas​

[pnpm audit] 命令将忽略的 GHSA 代码列表。

🌐 A list of GHSA codes that will be ignored by the pnpm audit command.

auditConfig:
  ignoreGhsas:
    - GHSA-42xw-2xvc-qx8m
    - GHSA-4w2v-q235-vp99
    - GHSA-cph5-m8f7-6c5x
    - GHSA-vh95-rmgr-6w4m

在 v11 之前，auditConfig.ignoreCves 用于按 CVE 标识符筛选通告。该设置不再被识别。

🌐 Before v11, auditConfig.ignoreCves was used to filter advisories by CVE identifier. That setting is no longer recognized.