ci(audit): don't block PRs when npm's audit endpoint is retired (410) - #341
Merged
Conversation
npm retired the legacy audit endpoint that `pnpm audit` (10.11.1) calls, so it exits non-zero with a 410 / ERR_PNPM_AUDIT_BAD_RESPONSE. The "Fail if vulnerabilities found" step keyed off that exit code and could not distinguish an endpoint outage from real findings, so it blocked every PR (e.g. #339, a clean dependency bump). Treat the 410/endpoint-retired error as "audit unavailable": warn and don't fail. Real high/critical findings (when the endpoint responds — e.g. the nightly run) still block. PR advisory coverage remains enforced by dependency-review-action (fail-on-severity: moderate).
Member
|
Claude finished @sonegillis1's task —— View job E2E Coverage Review
✅ E2E Coverage — No IssuesNo new app routes were introduced. Only CI workflow and changelog files changed. All existing coverage is intact. |
mamigot
approved these changes
Jul 15, 2026
mamigot
left a comment
mamigot
left a comment
Member
There was a problem hiding this comment.
✅ E2E Coverage — No Issues
No new app routes were introduced. All existing coverage is intact.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
npm has retired the legacy audit endpoint (
/-/npm/v1/security/audits) thatpnpm audit(10.11.1) calls.pnpm audit --audit-level=highnow exits non-zero with:The
auditjob's "Fail if vulnerabilities found" step keys off that exit code and can't distinguish an endpoint outage from real findings, so it now blocks every PR — e.g. #339 (a clean@iblai/iblai-jsbump whose full pre-push suite passed) failed the audit gate purely on the 410, not a vulnerability.Fix
In the "Run pnpm audit" step, detect the
410/ERR_PNPM_AUDIT_BAD_RESPONSE/ "being retired" response and treat it as "audit unavailable" — emit a::warning::and don't fail. Real high/critical findings (when the endpoint responds, e.g. the nightlyschedulerun) still produce a non-zero code and block as before.PR advisory coverage is unaffected —
dependency-review-action(fail-on-severity: moderate, independency-review.yml) still gates every PR against GitHub's advisory DB, which doesn't use the retired npm endpoint.Follow-up options (not in this PR)
The legacy endpoint isn't coming back, so
pnpm auditwill stay "unavailable" until either pnpm moves to the bulk advisory endpoint or we switch this job to a tool that uses it (e.g.osv-scanner, orpnpm dlx audit-ciagainst the bulk API). Happy to do that as a follow-up if you want the full-tree nightly audit working again — for now this unblocks PRs while keeping real-advisory enforcement via dependency-review.🤖 Generated with Claude Code