NodeAuditAnalyzer fails when hitting a 400 Bad Request where `npm audit` succeeds

Describe the bug

[DependencyCheck] [ERROR] NodeAuditAnalyzer failed on <redacted-path>/package-lock.json
[DependencyCheck] [WARN] An error occurred while analyzing <redacted-path>/package-lock.json' (Node Audit Analyzer).
[DependencyCheck] [INFO] Finished Node Audit Analyzer (0 seconds)
...
Could not perform Node Audit analysis. Invalid payload submitted to Node Audit API.

There are some similarities with #1632 and #1634, but those have been closed and we’re still having issues with version 5.2.0, hence this ticket.

Version of dependency-check used The problem occurs using version 5.2.0 of the CLI (but it was originally spotted using the Jenkins plugin).

To Reproduce Steps to reproduce the behavior:

1. Put the package-lock.json and package.json into a folder.
2. Run npm audit -registry=https://registry.npmjs.org. It succeeds and finds 81 vulnerabilities.
3. Point the NodeAuditAnalyzerIT.testAnalyzePackage() test to use the package-lock.json file in this folder, and run. Boom.

Expected behavior

1. the Node Audit should succeed
2. the behaviour should be consistent between dependency-check and npm audit!

[oliverlockwood]

@jeremylong apologies for my last message which turned out to be incorrect. I have just double-checked and it turns out we moved straight from 5.2.0 to 5.2.4, which resolved the issue we had seen. So I guess @skjolber’s issue must be a different variant.

[oliverlockwood]

@skjolber 5.2.3 did indeed fix the issue for us. But I haven’t tested with 5.2.4 yet 😬