propagate --no-audit for npm and yarn (#366)

peter-zhong-replit · web-flow · commit 0ffdf7d9f9bb · 2025-10-20T19:21:53.000Z
* don't audit

* only npm it seems

* Remove 'Unreleased' section from CHANGELOG

Removed the 'Unreleased' section and its details from the CHANGELOG.
diff --git a/README.md b/README.md
@@ -380,6 +380,12 @@ Here are useful things to know that aren't obvious:
   add`, `upm remove`, `upm lock`, and `upm install` (it is just
   `--force` for `upm install` due to lack of ambiguity) in order to
   ignore the cache for cases (1) and (2).
+* **Security audits:** The `upm add` command accepts a `--skip-audit`
+  (or `-s`) flag to skip security audits during package installation.
+  This flag only has an effect for the npm backend, which runs
+  security audits by default. For all other package managers, this
+  flag is ignored (as they don't have native audit functionality that
+  runs during installation, or don't support disabling it).
 
 ### Environment variables respected
 
diff --git a/internal/api/types.go b/internal/api/types.go
@@ -259,12 +259,16 @@ type LanguageBackend struct {
 	// required for initalizing specfiles, we can break that out
 	// to a seperate step.
 	//
+	// The skipAudit parameter indicates whether to skip security
+	// audits during installation (currently only supported by
+	// npm; ignored by other backends).
+	//
 	// If QuirksAddRemoveAlsoInstalls, then also lock and install.
 	// In this case this method must also create the lockfile if
 	// it does not exist already.
 	//
 	// This field is mandatory.
-	Add func(context.Context, map[PkgName]PkgCoordinates, string)
+	Add func(context.Context, map[PkgName]PkgCoordinates, string, bool)
 
 	// Remove packages from the specfile. The map is guaranteed to
 	// have at least one package, and all of the packages are
diff --git a/internal/backends/dart/dart.go b/internal/backends/dart/dart.go
@@ -257,7 +257,7 @@ func readSpecFile() dartPubspecYaml {
 	return specs
 }
 
-func dartAdd(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+func dartAdd(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 	//nolint:ineffassign,wastedassign,staticcheck
 	span, ctx := tracer.StartSpanFromContext(ctx, "dartAdd")
 	defer span.Finish()
diff --git a/internal/backends/dotnet/dotnet.go b/internal/backends/dotnet/dotnet.go
@@ -25,7 +25,7 @@ var DotNetBackend = api.LanguageBackend{
 	Remove: func(ctx context.Context, pkgs map[api.PkgName]bool) {
 		removePackages(ctx, pkgs, findSpecFile(), util.RunCmd)
 	},
-	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 		addPackages(ctx, pkgs, projectName, util.RunCmd)
 	},
 	Search:       search,
diff --git a/internal/backends/elisp/elisp.go b/internal/backends/elisp/elisp.go
@@ -87,7 +87,7 @@ var ElispBackend = api.LanguageBackend{
 		}
 		return info
 	},
-	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 		//nolint:ineffassign,wastedassign,staticcheck
 		span, ctx := tracer.StartSpanFromContext(ctx, "elisp add")
 		defer span.Finish()
diff --git a/internal/backends/java/java.go b/internal/backends/java/java.go
@@ -121,7 +121,7 @@ func isAvailable() bool {
 	return err == nil
 }
 
-func addPackages(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+func addPackages(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 	//nolint:ineffassign,wastedassign,staticcheck
 	span, ctx := tracer.StartSpanFromContext(ctx, "Java add package")
 	defer span.Finish()
diff --git a/internal/backends/nodejs/nodejs.go b/internal/backends/nodejs/nodejs.go
@@ -412,14 +412,15 @@ var NodejsYarnBackend = api.LanguageBackend{
 	},
 	Search: nodejsSearch,
 	Info:   nodejsInfo,
-	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 		//nolint:ineffassign,wastedassign,staticcheck
 		span, ctx := tracer.StartSpanFromContext(ctx, "yarn (init) add")
 		defer span.Finish()
 		if !util.Exists("package.json") {
 			util.RunCmd([]string{"yarn", "init", "-y"})
 		}
 		cmd := []string{"yarn", "add"}
+		// Note: Yarn (classic/v1) doesn't support --no-audit flag
 		for name, coords := range pkgs {
 			name := string(name)
 			if found, ok := moduleToYarnpkgPackageAliases[name]; ok {
@@ -500,7 +501,7 @@ var NodejsPNPMBackend = api.LanguageBackend{
 	},
 	Search: nodejsSearch,
 	Info:   nodejsInfo,
-	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 		//nolint:ineffassign,wastedassign,staticcheck
 		span, ctx := tracer.StartSpanFromContext(ctx, "pnpm (init) add")
 		defer span.Finish()
@@ -605,14 +606,17 @@ var NodejsNPMBackend = api.LanguageBackend{
 	},
 	Search: nodejsSearch,
 	Info:   nodejsInfo,
-	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 		//nolint:ineffassign,wastedassign,staticcheck
 		span, ctx := tracer.StartSpanFromContext(ctx, "npm (init) install")
 		defer span.Finish()
 		if !util.Exists("package.json") {
 			util.RunCmd([]string{"npm", "init", "-y"})
 		}
 		cmd := []string{"npm", "install"}
+		if skipAudit {
+			cmd = append(cmd, "--no-audit")
+		}
 		for name, coords := range pkgs {
 			name := string(name)
 			if found, ok := moduleToNpmjsPackageAliases[name]; ok {
@@ -716,7 +720,7 @@ func makeBunBackend() api.LanguageBackend {
 		},
 		Search: nodejsSearch,
 		Info:   nodejsInfo,
-		Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+		Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 			//nolint:ineffassign,wastedassign,staticcheck
 			span, ctx := tracer.StartSpanFromContext(ctx, "bun (init) add")
 			defer span.Finish()
diff --git a/internal/backends/php/php.go b/internal/backends/php/php.go
@@ -241,7 +241,7 @@ var PhpComposerBackend = api.LanguageBackend{
 	},
 	Search: search,
 	Info:   info,
-	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectVendorName string) {
+	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectVendorName string, skipAudit bool) {
 		//nolint:ineffassign,wastedassign,staticcheck
 		span, ctx := tracer.StartSpanFromContext(ctx, "composer require")
 		defer span.Finish()
diff --git a/internal/backends/python/python.go b/internal/backends/python/python.go
@@ -521,7 +521,7 @@ func makePythonPoetryBackend() api.LanguageBackend {
 
 		Search: searchPypi,
 		Info:   info,
-		Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+		Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 			//nolint:ineffassign,wastedassign,staticcheck
 			span, ctx := tracer.StartSpanFromContext(ctx, "poetry (init) add")
 			defer span.Finish()
@@ -669,7 +669,7 @@ func makePythonPipBackend() api.LanguageBackend {
 
 		Search: searchPypi,
 		Info:   info,
-		Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+		Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 			//nolint:ineffassign,wastedassign,staticcheck
 			span, ctx := tracer.StartSpanFromContext(ctx, "pip install")
 			defer span.Finish()
@@ -1014,7 +1014,7 @@ func makePythonUvBackend() api.LanguageBackend {
 
 		Search: searchPypi,
 		Info:   info,
-		Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+		Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 			//nolint:ineffassign,wastedassign,staticcheck
 			span, ctx := tracer.StartSpanFromContext(ctx, "uv (init) add")
 			defer span.Finish()
diff --git a/internal/backends/rlang/rlang.go b/internal/backends/rlang/rlang.go
@@ -130,7 +130,7 @@ var RlangBackend = api.LanguageBackend{
 
 		return api.PkgInfo{}
 	},
-	Add: func(ctx context.Context, packages map[api.PkgName]api.PkgCoordinates, projectName string) {
+	Add: func(ctx context.Context, packages map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 		for name, coords := range packages {
 			RAdd(ctx, RPackage{
 				Name:    string(name),
diff --git a/internal/backends/ruby/ruby.go b/internal/backends/ruby/ruby.go
@@ -177,7 +177,7 @@ var RubyBackend = api.LanguageBackend{
 			Dependencies:     deps,
 		}
 	},
-	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 		//nolint:ineffassign,wastedassign,staticcheck
 		span, ctx := tracer.StartSpanFromContext(ctx, "bundle (init) add")
 		defer span.Finish()
diff --git a/internal/backends/rust/rust.go b/internal/backends/rust/rust.go
@@ -237,7 +237,7 @@ var RustBackend = api.LanguageBackend{
 	},
 	Search: search,
 	Info:   info,
-	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {
+	Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {
 		//nolint:ineffassign,wastedassign,staticcheck
 		span, ctx := tracer.StartSpanFromContext(ctx, "cargo add")
 		defer span.Finish()
diff --git a/internal/cli/cli.go b/internal/cli/cli.go
@@ -57,6 +57,7 @@ func DoCLI() {
 	var ignoredPaths []string
 	var upgrade bool
 	var name string
+	var skipAudit bool
 
 	cobra.EnableCommandSorting = false
 
@@ -153,7 +154,7 @@ func DoCLI() {
 		Run: func(cmd *cobra.Command, args []string) {
 			pkgSpecStrs := args
 			runAdd(language, pkgSpecStrs, upgrade, guess, forceGuess,
-				ignoredPackages, forceLock, forceInstall, name)
+				ignoredPackages, forceLock, forceInstall, name, skipAudit)
 		},
 	}
 	cmdAdd.Flags().SortFlags = false
@@ -175,6 +176,9 @@ func DoCLI() {
 	cmdAdd.Flags().StringVarP(
 		&name, "name", "n", "", "specify project name",
 	)
+	cmdAdd.Flags().BoolVarP(
+		&skipAudit, "skip-audit", "s", false, "skip security audits (npm only)",
+	)
 	rootCmd.AddCommand(cmdAdd)
 
 	cmdRemove := &cobra.Command{
diff --git a/internal/cli/cmds.go b/internal/cli/cmds.go
@@ -288,7 +288,7 @@ func maybeInstall(ctx context.Context, b api.LanguageBackend, forceInstall bool)
 func runAdd(
 	language string, args []string, upgrade bool,
 	guess bool, forceGuess bool, ignoredPackages []string,
-	forceLock bool, forceInstall bool, name string) {
+	forceLock bool, forceInstall bool, name string, skipAudit bool) {
 	span, ctx := trace.StartSpanFromExistingContext("runAdd")
 	defer span.Finish()
 	b := backends.GetBackend(ctx, language)
@@ -353,7 +353,7 @@ func runAdd(
 	}
 
 	if len(normPkgs) >= 1 {
-		b.Add(ctx, normPkgs, name)
+		b.Add(ctx, normPkgs, name, skipAudit)
 	}
 
 	if len(normPkgs) == 0 || b.QuirksDoesAddRemoveNotAlsoLock() {
diff --git a/test-suite/Add_test.go b/test-suite/Add_test.go
@@ -75,3 +75,50 @@ func doAdd(bt testUtils.BackendT, pkgs ...string) {
 		}
 	}
 }
+
+func TestAddSkipAudit(t *testing.T) {
+	for _, bt := range languageBackends {
+		bt.Start(t)
+
+		// Only test skip-audit for npm since it supports --no-audit
+		switch bt.Backend.Name {
+		case "nodejs-npm":
+			bt.Subtest(bt.Backend.Name, func(bt testUtils.BackendT) {
+				bt.Subtest("skip-audit-flag", func(bt testUtils.BackendT) {
+					bt.AddTestDir("no-deps")
+					
+					// Test that --skip-audit flag is accepted and works
+					_, err := bt.Exec(
+						"upm",
+						"--lang",
+						bt.Backend.Name,
+						"add",
+						"--skip-audit",
+						"lodash",
+					)
+
+					if err != nil {
+						bt.Fail("upm add with --skip-audit failed: %v", err)
+					}
+
+					// Verify the package was actually added
+					afterSpecDeps := bt.UpmListSpecFile()
+					found := false
+					for _, dep := range afterSpecDeps {
+						if dep.Name == "lodash" {
+							found = true
+							break
+						}
+					}
+
+					if !found {
+						bt.Fail("expected lodash in spec file after add with --skip-audit")
+					}
+				})
+			})
+		default:
+			// Skip other backends as they don't support --skip-audit
+			continue
+		}
+	}
+}

Original file line number	Diff line number	Diff line change
`@@ -257,7 +257,7 @@ func readSpecFile() dartPubspecYaml {`
`257`	`257`	`return specs`
`258`	`258`	`}`
`259`	`259`
`260`		`-func dartAdd(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {`
	`260`	`+func dartAdd(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {`
`261`	`261`	`//nolint:ineffassign,wastedassign,staticcheck`
`262`	`262`	`span, ctx := tracer.StartSpanFromContext(ctx, "dartAdd")`
`263`	`263`	`defer span.Finish()`
Original file line number	Diff line number	Diff line change
`@@ -87,7 +87,7 @@ var ElispBackend = api.LanguageBackend{`
`87`	`87`	`}`
`88`	`88`	`return info`
`89`	`89`	`},`
`90`		`- Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {`
	`90`	`+ Add: func(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {`
`91`	`91`	`//nolint:ineffassign,wastedassign,staticcheck`
`92`	`92`	`span, ctx := tracer.StartSpanFromContext(ctx, "elisp add")`
`93`	`93`	`defer span.Finish()`
Original file line number	Diff line number	Diff line change
`@@ -121,7 +121,7 @@ func isAvailable() bool {`
`121`	`121`	`return err == nil`
`122`	`122`	`}`
`123`	`123`
`124`		`-func addPackages(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string) {`
	`124`	`+func addPackages(ctx context.Context, pkgs map[api.PkgName]api.PkgCoordinates, projectName string, skipAudit bool) {`
`125`	`125`	`//nolint:ineffassign,wastedassign,staticcheck`
`126`	`126`	`span, ctx := tracer.StartSpanFromContext(ctx, "Java add package")`
`127`	`127`	`defer span.Finish()`