aube audit

• Usage: aube audit [FLAGS]

Check installed packages against the registry advisory DB

Flags

--audit-level <AUDIT_LEVEL>

Only print advisories at or above this severity.

One of: low, moderate, high, critical. Default: low.

Choices:

• low
• moderate
• high
• critical

Default: low

-D --dev

Only audit devDependencies

--fix <FIX>

Fix advisories.

Bare --fix writes package.json overrides for backwards compatibility. --fix=update refreshes the lockfile without writing overrides.

Choices:

• update
• override

--ignore… <ID>

Drop advisories whose ID matches one of these values.

Matches against the numeric npm advisory id, github_advisory_id (GHSA-…), and any entry in cves[] (case-insensitive). Repeatable; comma-separated values are also accepted.

--ignore-registry-errors

Use exit code 0 if the registry responds with an error.

Useful when audit checks run in CI and the registry has a hiccup.

--ignore-unfixable

Drop advisories that have no non-vulnerable upgrade.

Filters out advisories for which no non-vulnerable version is available in the package's packument. Same "best non-vulnerable" logic as --fix: an advisory is kept only when an upgrade path exists.

-i --interactive

Pick which advisories to fix interactively

--json

Emit the report as JSON (pnpm-compatible shape) instead of a table

--no-optional

Skip optionalDependencies

-P --prod

Only audit dependencies and optionalDependencies

--fetch-retries <N>

Number of retry attempts for failed registry fetches.

Overrides fetchRetries / fetch-retries from .npmrc / aube-workspace.yaml when set. Pair with --fetch-timeout to fail fast in scripted test runs.

--fetch-retry-factor <N>

Exponential backoff factor between retry attempts.

Overrides fetchRetryFactor / fetch-retry-factor from .npmrc / aube-workspace.yaml when set. Integer-only — the underlying FetchPolicy.retry_factor is u32. Fractional values like 1.5 are rejected by clap.

--fetch-retry-maxtimeout <MS>

Upper bound (ms) on the computed retry backoff.

Overrides fetchRetryMaxtimeout / fetch-retry-maxtimeout from .npmrc / aube-workspace.yaml when set.

--fetch-retry-mintimeout <MS>

Lower bound (ms) on the computed retry backoff.

Overrides fetchRetryMintimeout / fetch-retry-mintimeout from .npmrc / aube-workspace.yaml when set.

--fetch-timeout <MS>

Per-request HTTP timeout in milliseconds.

Overrides fetchTimeout / fetch-timeout from .npmrc / aube-workspace.yaml when set. Applied via reqwest's .timeout() so it covers headers + body together.

--registry <URL>

Override the default registry URL for this invocation.

Use this npm registry URL for package metadata, tarballs, audit requests, dist-tags, and registry writes.

Examples:

$ aube audit Severity Package Vulnerable Title moderate minimatch ❤️.0.5 Regular Expression Denial of Service https://github.com/advisories/GHSA-f8q6-p94x

1 vulnerability found

Only fail on high and above

$ aube audit --audit-level high

Skip optional deps and dev deps

$ aube audit --prod --no-optional

Pipe into jq

$ aube audit --json | jq '.advisories | length'

Clean

$ aube audit No known vulnerabilities found