fix: improve consistency of results from YarnAuditAnalyzer - #8768
Merged
Conversation
chadlwilson
requested review from
jeremylong
and
a balanced review from Copilot
August 24, 2026 09:27
chadlwilson
force-pushed
the
conservative-yarn
branch
2 times, most recently
from
August 25, 2026 05:57
6d4d6b2 to
6926258
Compare
chadlwilson
force-pushed
the
conservative-yarn
branch
from
August 25, 2026 12:07
6926258 to
9c07e40
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 15 out of 19 changed files in this pull request and generated 1 comment.
Suppressed comments (2)
core/src/main/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzer.java:270
fetchYarnAdvisoriesnow invokesyarn npm auditand no longer passes--offline, but the method Javadoc above still documentsyarn audit --offlineand says it generates a payload for the NPM API. Update that Javadoc to describe the actual command and behavior so maintainers are not misled.
final String advisoriesJsons = startAndReadStdoutToString(createYarnBuilder(getDependencyDirectory(dependency.getActualFile()), args));
core/src/test/resources/yarn/yarn-classic-audit/package.json:19
- This fixture no longer declares
markedafter the dependency minimization, so the retained comment block above is now false and misleading. Please remove it or replace it with a comment describing the remaining fixture dependency.
"swig": "1.4.2"
chadlwilson
force-pushed
the
conservative-yarn
branch
3 times, most recently
from
August 26, 2026 05:05
be63cf3 to
9c6348f
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 15 out of 19 changed files in this pull request and generated 6 comments.
Suppressed comments (1)
core/src/test/java/org/owasp/dependencycheck/analyzer/YarnAuditAnalyzerIT.java:110
- The env var name is duplicated as a string literal. Using YarnAuditAnalyzer.YARN_ENV_IGNORE_PATH avoids drift if the production constant ever changes.
try (MockedStatic<SystemUtils> systemMock = mockStatic(SystemUtils.class)) {
systemMock.when(() -> SystemUtils.getEnvironmentVariable("YARN_IGNORE_PATH", null)).thenReturn(envValue);
chadlwilson
force-pushed
the
conservative-yarn
branch
from
August 26, 2026 06:08
9c6348f to
ffa6ff1
Compare
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
chadlwilson
force-pushed
the
conservative-yarn
branch
from
August 26, 2026 06:09
ffa6ff1 to
7b795d3
Compare
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
nhumblot
approved these changes
Sep 11, 2026
nhumblot
left a comment
nhumblot
left a comment
Collaborator
There was a problem hiding this comment.
praise: thank you for this proposal!
| | [RetireJS](./retirejs-analyzer.html) | JavaScript files | Analyzes JavaScript files using the [RetireJS](https://github.com/RetireJS/retire.js) database. | | ||
| | [Ruby bundler‑audit](./bundle-audit.html) | Ruby `Gemfile.lock` files | Executes bundle-audit and incorporates the results into the dependency-check report. | | ||
| | [Yarn Audit](./yarn-audit.html) | Yarn lock files (`yarn.lock`) | Uses the Yarn CLI `audit` command to analyze lock files and retrieve vulnerabilities from the NPM Audit APIs. | | ||
| | [Yarn Audit](./yarn-audit.html) | Yarn lock files (`yarn.lock`) | Uses the Yarn CLI `npm audit` command to analyze lock files and retrieve vulnerabilities from the NPM Audit APIs. | |
Collaborator
There was a problem hiding this comment.
suggestion: to remove ambiguity, we could formulate it:
Uses the
yarn npm auditcommand to analyze lock files and retrieve vulnerabilities from the NPM Audit APIs.
| ================ | ||
|
|
||
| Uses the Yarn CLI `audit` command to analyze `yarn.lock` files and retrieve vulnerabilities from the [NPM Audit](https://www.npmjs.com/) APIs. | ||
| Uses the Yarn CLI `npm audit` command to analyze `yarn.lock` files and retrieve vulnerabilities from the [NPM Audit](https://www.npmjs.com/) APIs. |
Collaborator
There was a problem hiding this comment.
suggestion: to remove ambiguity, we could formulate it:
Uses the
yarn npm auditcommand to analyze lock files and retrieve vulnerabilities from the NPM Audit APIs.
jeremylong
approved these changes
Sep 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of Change
Improves consistency of results from invoking yarn (via direct install or corepack) by ensuring use of the ODC environment-defined yarn version (via path or corepack validation)
npm auditAPI for dependencies that aren't actually asserted against in tests.Have test cases been added to cover the new functionality?
yes