You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
It would be useful if composer audit could work for npm-asset/ packages. composer audit reads a security-advisories key in the JSON returned by the repository.
Some other third-party Composer repositories have already implemented it (for example: https://repo.packagist.org/p2/drupal/core.json).
It should be possible to call the the NPM audit API (https://registry.npmjs.org/-/npm/v1/security/audits) and convert the result to the Composer format when building the Composer repository.
Hello.
Thank you for your idea!
We don't have enough resources to implement this enhancement right away, but this repo is tagged with the hacktoberfest tag, so maybe someone would like to push this idea to the implementation.
It would be useful if
composer audit
could work fornpm-asset/
packages.composer audit
reads asecurity-advisories
key in the JSON returned by the repository.Some other third-party Composer repositories have already implemented it (for example: https://repo.packagist.org/p2/drupal/core.json).
It should be possible to call the the NPM audit API (https://registry.npmjs.org/-/npm/v1/security/audits) and convert the result to the Composer format when building the Composer repository.
(I created a Composer plugin that does this but as a separate command: https://github.com/prudloff-insite/composer-npm-audit)
The text was updated successfully, but these errors were encountered: