Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Feature Request: Add option to run npm audit fix in bootstrap command

See original GitHub issue

Expected Behavior

Right now, I’ve tried to make lerna bootstrap run npm audit fix for the monorepo packages with no luck. I’d like to run lerna bootstrap to fix any sec vulnerabilities for the packages in the monorepo

Current Behavior

Doesn’t provide npm audit fix support as lerna only is concerning flags passed, not commands.

Possible Solution

N/A

Steps to Reproduce (for bugs)

Clone webpack-cli
Run lerna bootstrap
Try to run it with the -- override

Context

Improving project-wide security without having to navigate to each package and manually running npm audit fix

Your Environment

Executable	Version
`lerna --version`	3.14.1
`npm --version`	6.9
`node --version`	11.4

OS	Version
macOS Mojave	10.14.5

Issue Analytics

State:
Created 4 years ago
Reactions:14
Comments:7

Top GitHub Comments

7reactions

k3ncommented, Oct 10, 2019

@mchelen NPM doesn’t like that approach and throws ELOCKVERIFY in many of my packages complaining about “Errors were found in your package-lock.json, run npm install to fix them” and then listing symlinked packages. As such it doesn’t complete the audit actions.

3reactions

mesqueebcommented, Jul 3, 2020

This feature should be very high priority security wise!