{"record":{"id":"2c3899f26694355d","repo":"pnpm/pnpm","slug":"audit-no-packages","errorCode":"AUDIT_NO_PACKAGES","errorMessage":"No installed packages found to audit","messagePattern":"No installed packages found to audit","errorType":"exception","errorClass":"PnpmError","httpStatus":null,"severity":"warning","filePath":"pnpm11/deps/compliance/commands/src/audit/signatures.ts","lineNumber":20,"sourceCode":"import { pickRegistryForPackage } from '@pnpm/config.pick-registry-for-package'\nimport { lockfileToAuditRequest } from '@pnpm/deps.compliance.audit'\nimport { type SignaturePackage, type SignatureVerificationResult, verifySignatures } from '@pnpm/deps.security.signatures'\nimport { PnpmError } from '@pnpm/error'\nimport { createGetAuthHeaderByURI } from '@pnpm/network.auth-header'\nimport { table } from '@zkochan/table'\nimport chalk from 'chalk'\n\nimport type { AuditOptions } from './audit.js'\nimport { createAuditNetworkOptions, loadAuditContext } from './auditContext.js'\n\nexport async function auditSignatures (opts: AuditOptions): Promise<{ exitCode: number, output: string }> {\n  const { envLockfile, include, lockfile } = await loadAuditContext(opts)\n  const auditRequest = lockfileToAuditRequest(lockfile, { envLockfile, include })\n  const packages: SignaturePackage[] = Object.entries(auditRequest.request).flatMap(([name, versions]) => (\n    versions.map((version) => ({ name, registry: pickRegistryForPackage(opts.registries, name), version }))\n  ))\n  if (packages.length === 0) {\n    throw new PnpmError('AUDIT_NO_PACKAGES', 'No installed packages found to audit')\n  }\n\n  const getAuthHeader = createGetAuthHeaderByURI(opts.configByUri)\n  const networkOptions = createAuditNetworkOptions(opts)\n  const result = await verifySignatures(packages, getAuthHeader, {\n    ca: networkOptions.ca,\n    cert: networkOptions.cert,\n    configByUri: networkOptions.configByUri,\n    httpProxy: networkOptions.httpProxy,\n    httpsProxy: networkOptions.httpsProxy,\n    key: networkOptions.key,\n    localAddress: networkOptions.localAddress,\n    maxSockets: networkOptions.maxSockets,\n    networkConcurrency: opts.networkConcurrency,\n    noProxy: networkOptions.noProxy,\n    retry: networkOptions.retry,\n    strictSsl: networkOptions.strictSsl,\n    timeout: networkOptions.fetchTimeout,","sourceCodeStart":2,"sourceCodeEnd":38,"githubUrl":"https://github.com/pnpm/pnpm/blob/5b11d3a15b9022a2109cb18ed96a5d652630371f/pnpm11/deps/compliance/commands/src/audit/signatures.ts#L2-L38","documentation":"pnpm audit signatures builds its verification request from the lockfile via lockfileToAuditRequest. If the flattened name-to-versions map comes out empty there is nothing to verify, and the command throws AUDIT_NO_PACKAGES rather than reporting a vacuous result.","triggerScenarios":"Running pnpm audit signatures in a project whose lockfile contains zero dependencies; include filters (--prod/--dev/--no-optional combinations) excluding every dependency from the request.","commonSituations":"Brand-new packages before any dependency is added; CI templates that run signature audits unconditionally; over-restrictive include flags.","solutions":["Add or install at least one dependency before auditing signatures","Skip pnpm audit signatures on projects known to have no dependencies","Check that --prod/--dev/--no-optional flags are not filtering out the entire dependency set"],"exampleFix":"# before\npnpm init\npnpm audit signatures # nothing to audit\n\n# after\npnpm add lodash\npnpm audit signatures","handlingStrategy":"validation","validationCode":"import { lockfileToAuditRequest } from '@pnpm/audit'\n\nconst auditRequest = lockfileToAuditRequest(lockfile, { envLockfile, include })\nconst packageCount = Object.values(auditRequest.request).reduce((n, versions) => n + versions.length, 0)\nif (packageCount === 0) {\n  console.log('No installed packages to audit — skipping signature audit.')\n  process.exitCode = 0\n}","typeGuard":"function lockfileHasPackages (lockfile: { importers?: Record<string, { dependencies?: object, devDependencies?: object, optionalDependencies?: object }> }): boolean {\n  return Object.values(lockfile.importers ?? {}).some(imp =>\n    Object.keys(imp.dependencies ?? {}).length +\n    Object.keys(imp.devDependencies ?? {}).length +\n    Object.keys(imp.optionalDependencies ?? {}).length > 0)\n}","tryCatchPattern":null,"preventionTips":["Run pnpm install (with at least one dependency) before pnpm audit signatures","Gate the command in CI templates on the project having dependencies","Check that --prod/--dev/--no-optional filters are not excluding the entire dependency set"],"tags":["audit","signatures","usage","lockfile"],"backgroundTag":null,"analyzedSha":"5b11d3a15b9022a2109cb18ed96a5d652630371f","analyzedAt":"2026-08-16T13:18:59.198Z","schemaVersion":2},"datasetVersion":"2026-08-16T18:17:16.020Z"}