{"action":"created","issue":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808","repository_url":"https://api.github.com/repos/yarnpkg/yarn","labels_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808/labels{/name}","comments_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808/comments","events_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808/events","html_url":"https://github.com/yarnpkg/yarn/issues/5808","id":322265433,"number":5808,"title":"[feat] yarn audit","user":{"login":"rally25rs","id":38535,"avatar_url":"https://avatars3.githubusercontent.com/u/38535?v=4","gravatar_id":"","url":"https://api.github.com/users/rally25rs","html_url":"https://github.com/rally25rs","followers_url":"https://api.github.com/users/rally25rs/followers","following_url":"https://api.github.com/users/rally25rs/following{/other_user}","gists_url":"https://api.github.com/users/rally25rs/gists{/gist_id}","starred_url":"https://api.github.com/users/rally25rs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rally25rs/subscriptions","organizations_url":"https://api.github.com/users/rally25rs/orgs","repos_url":"https://api.github.com/users/rally25rs/repos","events_url":"https://api.github.com/users/rally25rs/events{/privacy}","received_events_url":"https://api.github.com/users/rally25rs/received_events","type":"User","site_admin":false},"labels":[{"id":446993282,"url":"https://api.github.com/repos/yarnpkg/yarn/labels/cat-compatibility","name":"cat-compatibility","color":"77543b","default":false},{"id":313603439,"url":"https://api.github.com/repos/yarnpkg/yarn/labels/cat-feature","name":"cat-feature","color":"84b6eb","default":false},{"id":594039992,"url":"https://api.github.com/repos/yarnpkg/yarn/labels/high-priority","name":"high-priority","color":"5b1616","default":false}],"state":"open","locked":false,"assignee":{"login":"rally25rs","id":38535,"avatar_url":"https://avatars3.githubusercontent.com/u/38535?v=4","gravatar_id":"","url":"https://api.github.com/users/rally25rs","html_url":"https://github.com/rally25rs","followers_url":"https://api.github.com/users/rally25rs/followers","following_url":"https://api.github.com/users/rally25rs/following{/other_user}","gists_url":"https://api.github.com/users/rally25rs/gists{/gist_id}","starred_url":"https://api.github.com/users/rally25rs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rally25rs/subscriptions","organizations_url":"https://api.github.com/users/rally25rs/orgs","repos_url":"https://api.github.com/users/rally25rs/repos","events_url":"https://api.github.com/users/rally25rs/events{/privacy}","received_events_url":"https://api.github.com/users/rally25rs/received_events","type":"User","site_admin":false},"assignees":[{"login":"rally25rs","id":38535,"avatar_url":"https://avatars3.githubusercontent.com/u/38535?v=4","gravatar_id":"","url":"https://api.github.com/users/rally25rs","html_url":"https://github.com/rally25rs","followers_url":"https://api.github.com/users/rally25rs/followers","following_url":"https://api.github.com/users/rally25rs/following{/other_user}","gists_url":"https://api.github.com/users/rally25rs/gists{/gist_id}","starred_url":"https://api.github.com/users/rally25rs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rally25rs/subscriptions","organizations_url":"https://api.github.com/users/rally25rs/orgs","repos_url":"https://api.github.com/users/rally25rs/repos","events_url":"https://api.github.com/users/rally25rs/events{/privacy}","received_events_url":"https://api.github.com/users/rally25rs/received_events","type":"User","site_admin":false}],"milestone":null,"comments":8,"created_at":"2018-05-11T11:35:56Z","updated_at":"2018-05-21T14:51:59Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"<!-- *Before creating an issue please make sure you are using the latest version of yarn.* -->\r\n\r\n**Do you want to request a *feature* or report a *bug*?**\r\n\r\nfeature\r\n\r\n**What is the current behavior?**\r\n\r\nnpm added `audit` to warn about packages with known security issues. There was some conversation about this previously and one of the core npm folks said the API was likely to be open/public to pull this info. Therefore, yarn should be able to add this feature.\r\n\r\n**What is the expected behavior?**\r\n\r\n* Add a `yarn audit` command that mimics `npm audit`\r\n* Add warnings when adding/installing packages with known issues.\r\n\r\n**Please mention your node.js, yarn and operating system version.**\r\n\r\nThis would be a minor version bump, so likely target yarn v1.7.0 or v1.8.0 depending on timing.\r\nThis is probably too important to wait for v2.0."},"comment":{"url":"https://api.github.com/repos/yarnpkg/yarn/issues/comments/390677850","html_url":"https://github.com/yarnpkg/yarn/issues/5808#issuecomment-390677850","issue_url":"https://api.github.com/repos/yarnpkg/yarn/issues/5808","id":390677850,"user":{"login":"rally25rs","id":38535,"avatar_url":"https://avatars3.githubusercontent.com/u/38535?v=4","gravatar_id":"","url":"https://api.github.com/users/rally25rs","html_url":"https://github.com/rally25rs","followers_url":"https://api.github.com/users/rally25rs/followers","following_url":"https://api.github.com/users/rally25rs/following{/other_user}","gists_url":"https://api.github.com/users/rally25rs/gists{/gist_id}","starred_url":"https://api.github.com/users/rally25rs/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rally25rs/subscriptions","organizations_url":"https://api.github.com/users/rally25rs/orgs","repos_url":"https://api.github.com/users/rally25rs/repos","events_url":"https://api.github.com/users/rally25rs/events{/privacy}","received_events_url":"https://api.github.com/users/rally25rs/received_events","type":"User","site_admin":false},"created_at":"2018-05-21T14:51:59Z","updated_at":"2018-05-21T14:51:59Z","author_association":"CONTRIBUTOR","body":"Discovered that the `integrity` _may_ be returned by the registry for newer packages in the metadata under `versions[version_number].dist.integrity`\r\n\r\nWhen that does not exist, [the npm lockfile docs](https://github.com/npm/npm/blob/1365694bb3da9be95964a4eb6c92b1c71d0edde5/doc/spec/package-lock.md#integrity-new) says \"the sha1 in `shasum`\" but I haven't quite figured out how that is generated.\r\n\r\nhttps://github.com/zkat/pacote/blob/ccc6e9094c2e872f09cc12ae966a0cbc1a570eed/lib/finalize-manifest.js#L100 leads me to believe that npm generates the missing integrity from the tarball, but watching network traffic, it has not yet downloaded the tarball 🤔 \r\n\r\n@zkat @imsnif can you provide any details as to how this works? (just asking is probably a lot easier than me hunting through the code 😄I appreciate any help!)"}}
{"actor":{"display_login":"rally25rs"}}