Skip to content

Conversation

@matejchalk
Copy link
Collaborator

Yarn Berry's yarn npm audit command by default only reports vulnerabilities in direct dependencies, not transitive dependencies. Adding --recursive flag brings it in line with audit commands from other package managers.

Also, found out that it's possible to get outdated package URLs in yarn-plugin-outdated by adding --url flag. So reported issues for Yarn Berry should now include Markdown links, not just the package name.

@github-actions github-actions bot added 🔬 testing writing tests 🧩 js-packages-plugin Plugin for audit and outdated dependencies labels Jul 11, 2025
@github-actions
Copy link
Contributor

Code PushUp

🤨 Code PushUp report has both improvements and regressions – compared current commit e0de0b4 with previous commit 3451929.

🕵️ See full comparison in Code PushUp portal 🔍

🏷️ Categories

🏷️ Category ⭐ Previous score ⭐ Current score 🔄 Score change
Performance 🟡 54 🔴 49 ↓ −5.5
Code coverage 🟢 90 🟢 90 ↑ +0.1
Documentation 🔴 23 🔴 23 ↑ +0.1
Security 🟡 61 🟡 61
Updates 🟡 74 🟡 74
Accessibility 🟢 92 🟢 92
Best Practices 🟢 100 🟢 100
SEO 🟡 61 🟡 61
Type Safety 🟢 100 🟢 100
Bug prevention 🟢 100 🟢 100
Miscellaneous 🟢 100 🟢 100
Code style 🟢 100 🟢 100
👍 2 groups improved, 👎 1 group regressed, 👍 2 audits improved, 👎 6 audits regressed, 9 audits changed without impacting score

🗃️ Groups

🔌 Plugin 🗃️ Group ⭐ Previous score ⭐ Current score 🔄 Score change
Lighthouse Performance 🟡 54 🔴 49 ↓ −5.5
Code coverage Code coverage metrics 🟢 90 🟢 90 ↑ +0.1
JSDoc coverage Documentation coverage 🔴 23 🔴 23 ↑ +0.1

18 other groups are unchanged.

🛡️ Audits

🔌 Plugin 🛡️ Audit 📏 Previous value 📏 Current value 🔄 Value change
Lighthouse Largest Contentful Paint 🟨 3.5 s 🟨 3.9 s ↑ +10.3 %
Lighthouse Speed Index 🟨 5.6 s 🟥 6.2 s ↑ +9.6 %
Lighthouse Total Blocking Time 🟥 1,720 ms 🟥 2,510 ms ↑ +46.2 %
Lighthouse First Contentful Paint 🟨 2.8 s 🟨 2.9 s ↑ +2 %
Lighthouse Time to Interactive 🟥 13.1 s 🟥 13.8 s ↑ +5.5 %
Code coverage Line coverage 🟨 86.6 % 🟨 86.5 % ↓ −0.1 %
JSDoc coverage Variables coverage 🟥 218 undocumented variables 🟥 216 undocumented variables ↓ −0.9 %
Code coverage Branch coverage 🟨 85.7 % 🟨 85.7 % ↑ +0.1 %
Lighthouse Minimizes main-thread work 🟥 11.5 s 🟥 13.3 s ↑ +16.3 %
Lighthouse JavaScript execution time 🟥 5.0 s 🟥 6.4 s ↑ +28.1 %
Lighthouse Metrics 🟩 100% 🟩 100% ↑ +5.5 %
Lighthouse Max Potential First Input Delay 🟥 1,020 ms 🟥 1,450 ms ↑ +42.2 %
Lighthouse Avoids enormous network payloads 🟩 Total size was 1,944 KiB 🟩 Total size was 1,944 KiB ↓ −0.1 %
Lighthouse Uses efficient cache policy on static assets 🟨 30 resources found 🟨 30 resources found ↓ −0.1 %
Lighthouse Server Backend Latencies 🟩 140 ms 🟩 180 ms ↑ +22.3 %
Lighthouse Initial server response time was short 🟩 Root document took 410 ms 🟩 Root document took 420 ms ↑ +3.2 %
Lighthouse Network Round Trip Times 🟩 20 ms 🟩 20 ms ↓ −29.8 %

588 other audits are unchanged.

@matejchalk matejchalk merged commit 8e285e9 into main Jul 11, 2025
17 checks passed
@matejchalk matejchalk deleted the yarn-modern-audit-recursive branch July 11, 2025 11:04
@matejchalk matejchalk requested a review from Tlacenka July 11, 2025 11:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

🧩 js-packages-plugin Plugin for audit and outdated dependencies 🔬 testing writing tests

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants