Support for bun audit (like npm/yarn audit) #5359

Calvein · 2023-09-14T09:58:16Z

What is the problem this feature would solve?

I'm trying to replace node, yarn & jest with bun and the only missing feature to replace our workflow is an equivalent to yarn audit.

What is the feature you are proposing to solve the problem?

Add bun audit which would work like npm/yarn audit.

What alternatives have you considered?

I run bun install with the --yarn flag to be able to run yarn audit

The text was updated successfully, but these errors were encountered:

melroy89 · 2023-09-16T17:13:54Z

I'm kinda surprised this command is really missing. Or do I miss something?

tomerh2001 · 2023-09-25T18:20:39Z

+1
Any updates?

melroy89 · 2023-09-25T19:09:57Z

+1 Any updates?

I don't think it's implemented in v1.0.3 either. So no. No update. Maybe it will be part of any future roadmap?

tomerh2001 · 2023-09-25T20:03:37Z

+1 Any updates?

I don't think it's implemented in v1.0.3 either. So no. No update. Maybe it will be part of any future roadmap?

Uh I see, do you know of any temporary alternatives we could use until then? Ones that doesn't require a specific pm (I. E. Could be used with bun)

melroy89 · 2023-09-25T20:09:49Z

Uh I see, do you know of any temporary alternatives we could use until then? Ones that doesn't require a specific pm (I. E. Could be used with bun)

Not really.. but maybe try upgradeps:

bun install upgradeps

And then run (for the audit feature):

bunx upgradeps

Example output:

upgradeps v2.0.6 ─ run with -h to output usage information
✘ typescript 5.0.0 → 5.2.2 minor last publish 1 month ago
  1 dependency 1 minor

alec-c4 · 2023-11-24T17:13:36Z

+1

LucyEgan · 2023-11-27T15:22:21Z

+1

MendyLanda · 2024-01-01T15:35:08Z

+1

avan2s · 2024-02-15T07:34:45Z

Anything here planned in the next time? Especially bun audit fix would be great like npm audit fix. The package-lock json is touched sometimes and i think the bun.lockb should do as well.

HDVinnie · 2024-03-13T04:24:23Z

Would love to see this added as well.

jase88 · 2024-03-19T18:43:47Z

It would be great to have this feature in bun.

Ideally with features that are missing in other package managers, such as the ability to ignore certain security vulnerabilities for the time being by giving a reason (like implemented in npm-audit-resolver)

vhscom · 2024-04-12T00:27:54Z

Trivy is a useful security scanning tool for polyglot projects. Rather than just running an npm audit you can use Trivy to both audit your JavaScript modules, Dockerfiles, go modules, and more in a single-shot CLI fashion:

 trivy fs /path/to/project # don't make me do stuff

hussain-nz · 2024-05-10T06:41:01Z

I know it sucks but I found it easier to just stick with npm run audit, of course it doesn't work without package-lock.json but you can generate this effectively with a flag (16 seconds on our Azure CI server) : npm i --package-lock-only

lgarron · 2024-05-10T07:10:36Z

I know it sucks but I found it easier to just stick with npm run audit, of course it doesn't work without package-lock.json but you can generate this effectively with a flag (16 seconds on our Azure CI server) : npm i --package-lock-only

This sounds like a useful workaround in theory, but it has a huge issue: the package versions in a lockfile that npm would generate at a given moment will not generally match the versions frozen in bun.lockb. This can easily cause a false negative, which is bad for a security feature like this.

This workaround would get a lot more practical if bun had a way to output bun.lockb in package-lock.json format. (I know bun bun.lockb prints the contents, but certainly not in JSON format.) That might also make it more practical for GitHub to index bun.lockb files and support it for Dependabot in the future.

lgarron · 2024-06-05T07:47:55Z

I'm now in a situation where I maintain a repo that has "9 high severity vulnerabilities" but I can't properly audit or upgrade them using bun.

I am fine with this for personal projects, but I'm worried this is borderline-untenable for anyone considering bun for use at work. 😬

If bun documented and supported a canonical way to run an npm audit over a bun.lockb in the near future, this would be a significant stopgap. As mentioned above, it could allow GitHub to integrate with Dependabot in the long-term, which would be a much better experience than finding out about vulnerabilities months too late.

And at least in the short-term it would be possible to set up a GitHub action to run such a check on a schedule in each individual repo for now.

Jarred-Sumner · 2024-06-05T10:01:04Z

If bun documented and supported a canonical way to run an npm audit over a bun.lockb in the near future, this would be a significant stopgap. As mentioned above, it could allow GitHub to integrate with Dependabot in the long-term, which would be a much better experience than finding out about vulnerabilities months too late.

If you run bun bun.lockb, it will produce a yarn v1 yarn.lock file. I wonder if there's a way to get npm audit to run on that?

goamn · 2024-06-05T10:08:31Z

If bun documented and supported a canonical way to run an npm audit over a bun.lockb in the near future, this would be a significant stopgap. As mentioned above, it could allow GitHub to integrate with Dependabot in the long-term, which would be a much better experience than finding out about vulnerabilities months too late.

If you run bun bun.lockb, it will produce a yarn v1 yarn.lock file. I wonder if there's a way to get npm audit to run on that?

I believe yarn v1 does have an audit command: https://classic.yarnpkg.com/lang/en/docs/cli/audit/

tim-brand · 2024-06-05T10:17:36Z

If bun documented and supported a canonical way to run an npm audit over a bun.lockb in the near future, this would be a significant stopgap. As mentioned above, it could allow GitHub to integrate with Dependabot in the long-term, which would be a much better experience than finding out about vulnerabilities months too late.

If you run bun bun.lockb, it will produce a yarn v1 yarn.lock file. I wonder if there's a way to get npm audit to run on that?

Great suggestion!
I tested it, and it works: bun bun.lockb > yarn.lock && yarn audit

lgarron · 2024-06-05T19:24:09Z

If bun documented and supported a canonical way to run an npm audit over a bun.lockb in the near future, this would be a significant stopgap. As mentioned above, it could allow GitHub to integrate with Dependabot in the long-term, which would be a much better experience than finding out about vulnerabilities months too late.

If you run bun bun.lockb, it will produce a yarn v1 yarn.lock file. I wonder if there's a way to get npm audit to run on that?

Great suggestion! I tested it, and it works: bun bun.lockb > yarn.lock && yarn audit

Ah, that's fantastic! 😄

I don't use yarn, so I didn't realize bun bun.lockb was outputting yarn-compatible data!

I'm not a huge fan of having to use yarn in addition to node, npm, and bun, but it's certainly a very good stopgap until bun audit exists!

EDIT: here's a little script I made to avoid writing yarn.lock into repos:

#!/usr/bin/env bun

import { $, spawn } from "bun";
import { cp, mkdtemp, rm } from "node:fs/promises";
import { join } from "node:path";
import { exit } from "node:process";

const tempDir = await mkdtemp("/tmp/bun-audit-temp-");
let exitCode = 0;
try {
  await cp("package.json", join(tempDir, "package.json"));
  await $`bun bun.lockb > ${join(tempDir, "yarn.lock")}`;
  exitCode = await spawn(["bun", "x", "yarn", "--cwd", tempDir, "audit"], {
    stdout: "inherit",
  }).exited;
} finally {
  await rm(tempDir, { force: true, recursive: true });
}
exit(exitCode);

EDIT 2: Published as a package, so you can run: bun x bun-audit
Repo at: https://github.com/lgarron/bun-audit

lgarron · 2024-06-27T21:49:39Z

EDIT 2: Published as a package, so you can run: bun x bun-audit
Repo at: https://github.com/lgarron/bun-audit

I've been relying on this for a while, but it's kind of inadequate for addressing vulns.

The ip package has a vulnerability and is unmaintained, which took a while for other projects to work around, e.g. modernweb-dev/web#2747

npm audit fix works if I switch my project to use a package-lock.json file, but I can't figure out how to use bun update to bump enough packages to avoid the vulnerable dep, even if I try to combine it with npx npm-check-updates -u. 😕

A bun audit fix command is critical for real-world projects that wish (or are legally required to) address vulnerabilities in a timely manner.

redbmk · 2024-07-11T22:48:34Z

I've seen cases where the yarn.lock file isn't 100% compatible with yarn, and yarn audit will have issues. Some examples:

Using package.json overrides

❯ cat package.json | jq .overrides
{
  "braces": "^3.0.3",
  "debug": "^4.3.4",
  "express": "^4.19.2",
  "ip": "^2.0.1",
  "jose": "^4.15.5",
  "ws": "^8.18.0"
}
❯ grep ^ws@ -A1 yarn.lock
ws@^8.11.0, ws@^8.14.2, ws@^8.17.0, ws@~8.11.0:
  version "8.18.0"
❯ yarn audit
yarn audit v1.22.21
warning Lockfile has incorrect entry for "debug@^3.1.0". Ignoring it.
warning Lockfile has incorrect entry for "[email protected]". Ignoring it.
warning Lockfile has incorrect entry for "ws@~8.11.0". Ignoring it.
warning Lockfile has incorrect entry for "ip@^1.1.8". Ignoring it.

In this case it finds an issue with ws which was resolved in 8.17.1. Yarn thinks that 8.18.0 is an invalid version for ~8.11.0 and then treats it as if it resolved to 8.11.0, which has the vulnerability. Bun however, only actually installs 8.18.0.

It's possible newer lockfile versions of yarn handle this better or there might be some other syntax that works with the v1 lockfile.

Pointing to a commit on github

❯ cat package.json | jq '.dependencies["@xenova/transformers"]'
"xenova/transformers.js#v3"
❯ cat yarn.lock | grep -A2 '^"@xenova'
"@xenova/transformers@^2.17.2":
  version "2.17.2"
  resolved "https://registry.npmjs.org/@xenova/transformers/-/transformers-2.17.2.tgz"
--
"@xenova/transformers@xenova/transformers.js#v3":
  version "github:xenova/transformers.js#c390936"
  resolved "github:xenova/transformers.js#c390936"
❯ yarn audit
❯ yarn audit
yarn audit v1.22.21
warning package.json: No license field
warning [email protected]: No license field
error Can't add "@xenova/transformers": invalid package version "github:xenova/transformers.js#c390936".
info Visit https://yarnpkg.com/en/docs/cli/audit for documentation about this command.

One sort of workaround is to use synp and npm audit which seems to work in this case, however I think synp is actually just ignoring that version because the package-lock.json it generates only shows 2.17.2:

❯ bunx [email protected] --source-file yarn.lock
Created package-lock.json
❯ grep xenova package-lock.json
        "@xenova/transformers": "^2.17.2",
        "@xenova/transformers": {
          "resolved": "https://registry.npmjs.org/@xenova/transformers/-/transformers-2.17.2.tgz",
❯ npm audit
found 0 vulnerabilities

Eveeifyeve · 2024-08-03T09:09:51Z

I would say this would have to some how call bun.lockb and do the same functions as yarn audit. It is possible I will see after my bun publish command to try to implement this.

Eveeifyeve · 2024-08-03T09:11:25Z

As this would be useful to check for vulnerabilities. I don't know how it will exactly would work, but @Jarred-Sumner or someone from the core team could possibly help me?

LucyEgan · 2024-10-08T15:40:46Z

Any updates on this outside of using yarn?

Eveeifyeve · 2024-10-09T03:07:49Z

I will look into making this command as I kinda ran out of ideas as I wasn't quick enough to make bun publish.

lgarron · 2024-10-29T18:59:18Z

This is becoming more and more of an issue with some of my projects.

When there are vulnerabilities in transitive dependencies like rollup (which is used by a lot of packages under the hood), it's extremely non-trivial to upgrade dependent packages by hand. I can usually figure it out by trying to get bun to pick up updates from npm audit fix, but it usually involves regenerating dependency pins from scratch. This has gone well so far, but it's only a matter of time before this breaks something due to an accidental upgrade in a non-vulnerable dependency. 🙁

aliofye · 2024-12-26T03:10:56Z

@Eveeifyeve you made any progress? I'm thinking about taking a stab at it and don't want to duplicate efforts

Eveeifyeve · 2024-12-26T04:57:09Z

@Eveeifyeve you made any progress? I'm thinking about taking a stab at it and don't want to duplicate efforts

No I have been really busy doing other things I now work at other company’s then I was before.

Calvein added the enhancement New feature or request label Sep 14, 2023

rodhoward mentioned this issue Sep 14, 2023

Bun Audit: A replacement for npm-audit #5369

Closed

ghiscoding mentioned this issue Sep 15, 2023

Bun audit fix --force #5474

Closed

Electroid mentioned this issue Apr 25, 2024

bun audit not exists #10520

Closed

Electroid added the bun install Something that relates to the npm-compatible client label Apr 25, 2024

astone123 mentioned this issue Aug 26, 2024

Dont know how to fix vulnerabilities with bun wweitzel/top90-frontend#115

Closed

LucyEgan mentioned this issue Oct 9, 2024

Authorized on tlsSocket missing causing yarn to fail #14430

Open

tjarross mentioned this issue Nov 1, 2024

Encore des vulnérabilités lors de l'installation du projet avec NPM cartesapp/cartes#669

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Support for bun audit (like npm/yarn audit) #5359

Support for bun audit (like npm/yarn audit) #5359

Calvein commented Sep 14, 2023

melroy89 commented Sep 16, 2023

tomerh2001 commented Sep 25, 2023

melroy89 commented Sep 25, 2023

tomerh2001 commented Sep 25, 2023

melroy89 commented Sep 25, 2023 •

edited

Loading

alec-c4 commented Nov 24, 2023

LucyEgan commented Nov 27, 2023

MendyLanda commented Jan 1, 2024

avan2s commented Feb 15, 2024

HDVinnie commented Mar 13, 2024

jase88 commented Mar 19, 2024

vhscom commented Apr 12, 2024

hussain-nz commented May 10, 2024

lgarron commented May 10, 2024 •

edited

Loading

lgarron commented Jun 5, 2024 •

edited

Loading

Jarred-Sumner commented Jun 5, 2024

goamn commented Jun 5, 2024

tim-brand commented Jun 5, 2024

lgarron commented Jun 5, 2024 •

edited

Loading

lgarron commented Jun 27, 2024

redbmk commented Jul 11, 2024

Eveeifyeve commented Aug 3, 2024

Eveeifyeve commented Aug 3, 2024

LucyEgan commented Oct 8, 2024

Eveeifyeve commented Oct 9, 2024

lgarron commented Oct 29, 2024

aliofye commented Dec 26, 2024

Eveeifyeve commented Dec 26, 2024

Support for bun audit (like npm/yarn audit) #5359

Support for bun audit (like npm/yarn audit) #5359

Comments

Calvein commented Sep 14, 2023

What is the problem this feature would solve?

What is the feature you are proposing to solve the problem?

What alternatives have you considered?

melroy89 commented Sep 16, 2023

tomerh2001 commented Sep 25, 2023

melroy89 commented Sep 25, 2023

tomerh2001 commented Sep 25, 2023

melroy89 commented Sep 25, 2023 • edited Loading

alec-c4 commented Nov 24, 2023

LucyEgan commented Nov 27, 2023

MendyLanda commented Jan 1, 2024

avan2s commented Feb 15, 2024

HDVinnie commented Mar 13, 2024

jase88 commented Mar 19, 2024

vhscom commented Apr 12, 2024

hussain-nz commented May 10, 2024

lgarron commented May 10, 2024 • edited Loading

lgarron commented Jun 5, 2024 • edited Loading

Jarred-Sumner commented Jun 5, 2024

goamn commented Jun 5, 2024

tim-brand commented Jun 5, 2024

lgarron commented Jun 5, 2024 • edited Loading

lgarron commented Jun 27, 2024

redbmk commented Jul 11, 2024

Using package.json overrides

Pointing to a commit on github

Eveeifyeve commented Aug 3, 2024

Eveeifyeve commented Aug 3, 2024

LucyEgan commented Oct 8, 2024

Eveeifyeve commented Oct 9, 2024

lgarron commented Oct 29, 2024

aliofye commented Dec 26, 2024

Eveeifyeve commented Dec 26, 2024

melroy89 commented Sep 25, 2023 •

edited

Loading

lgarron commented May 10, 2024 •

edited

Loading

lgarron commented Jun 5, 2024 •

edited

Loading

lgarron commented Jun 5, 2024 •

edited

Loading