Add a flag to ignore devDependencies when running yarn audit

[sam-warren-finnair]

Do you want to request a feature or report a bug?

Feature

What is the current behavior?

When running yarn audit dev dependencies are included in the check.

If the current behavior is a bug, please provide the steps to reproduce.

What is the expected behavior?

Add a flag to ignore dev dependencies when running the audit. This has also been reported on npm/npm#20564.

Perhaps the --production flag could be used for this?

Please mention your node.js, yarn and operating system version.

Mac: 10.14 (18A391)
Node: v8.11.3
Yarn: 1.12.1

[tommilligan]

As mentioned in the npm issue, using the --production flag would be a backwards incompatible change for yarn install - it would hide vulnerabilities that currently error during install.

I've submitted a PR that adds a --groups flag to yarn audit, with the currently scanned groups being the default option. If someone has a better idea for an API I'm happy to implement it.

[wavebeem]

When running yarn audit dev dependencies are included in the check.

I'm incredibly confused by this—when I was testing differences between yarn audit and npm audit, this was the only major difference I saw. npm checked devDependencies, whereas yarn does NOT. I checked and there are transitive dev dependencies in my example project with vulnerabilities that only npm finds, not yarn.

[lneves12]

@wavebeem the same happened to me. Yarn by default is only detecting vulnerabilities on the dependencies and not devDependencies. Did you find a way to detect it on both?

[lneves12]

@wavebeem It seems that using workspaces it only audits the dependencies and not devDependencies

[wavebeem]

I did not find a way to change the behavior. We switched back to npm at work anyway.

[robertlagrant]

We're also seeing yarn audit pick up a security vulnerability in a 5 levels deep dependency of a devDependency, so it seems to do this at least under some circumstances.

[lneves12]

@robertlagrant it seems that if you have a single workspace project it audits all the dependencies but if it's a multi workspaces project it doesn't audit the dev dependencies. I opened an issue for that: #7047