{"record":{"id":"8c98146fd47ebf22","repo":"pnpm/pnpm","slug":"audit-missing-ghsa","errorCode":"AUDIT_MISSING_GHSA","errorMessage":"Cannot ignore advisory ${advisory.id} (${advisory.module_name}): the registry did not provide a GHSA id or a resolvable url.","messagePattern":"Cannot ignore advisory (.+?) \\((.+?)\\): the registry did not provide a GHSA id or a resolvable url\\.","errorType":"exception","errorClass":"PnpmError","httpStatus":null,"severity":"error","filePath":"pnpm11/deps/compliance/commands/src/audit/ignore.ts","lineNumber":29,"sourceCode":"  auditReport: AuditReport\n  rootProjectManifest?: ProjectManifest\n  rootProjectManifestDir: string\n  workspaceDir: string\n  auditConfig?: AuditConfig\n}\n\nexport async function ignore (opts: IgnoreVulnerabilitiesOptions): Promise<string[]> {\n  // GHSA IDs are canonically uppercase; normalize on read/write so a stored\n  // \"ghsa-...\" or uppercase user input both match the derived id at filter\n  // time.\n  const currentGhsas = (opts?.auditConfig?.ignoreGhsas ?? []).map(normalizeGhsaId)\n  const currentUniqueGhsas = new Set(currentGhsas)\n  const advisoriesWithNoResolutions = filterAdvisoriesWithNoResolutions(Object.values(opts.auditReport.advisories))\n\n  if (opts.ignoreUnfixable) {\n    for (const advisory of advisoriesWithNoResolutions) {\n      if (!advisory.github_advisory_id) {\n        throw new PnpmError(\n          'AUDIT_MISSING_GHSA',\n          `Cannot ignore advisory ${advisory.id} (${advisory.module_name}): the registry did not provide a GHSA id or a resolvable url.`\n        )\n      }\n      currentUniqueGhsas.add(normalizeGhsaId(advisory.github_advisory_id))\n    }\n  } else if (opts.ignore) {\n    for (const ghsa of opts.ignore) {\n      currentUniqueGhsas.add(normalizeGhsaId(ghsa))\n    }\n  }\n\n  const newIgnoreGhsas = currentUniqueGhsas.size > 0 ? Array.from(currentUniqueGhsas) : undefined\n  const diffGhsas = difference(newIgnoreGhsas ?? [], currentGhsas)\n  await writeSettings({\n    ...opts,\n    updatedSettings: {\n      auditConfig: {","sourceCodeStart":11,"sourceCodeEnd":47,"githubUrl":"https://github.com/pnpm/pnpm/blob/5b11d3a15b9022a2109cb18ed96a5d652630371f/pnpm11/deps/compliance/commands/src/audit/ignore.ts#L11-L47","documentation":"With --ignore-unfixable, pnpm auto-records advisories that have no resolutions into the ignore list, keyed by GHSA id (normalized to uppercase). An advisory that carries neither github_advisory_id nor a resolvable url has no stable key to store, so ignore() throws AUDIT_MISSING_GHSA instead of silently dropping it.","triggerScenarios":"pnpm audit --ignore-unfixable when the registry's advisory data for an unfixable package lacks a GHSA reference — a data gap on the registry side (some older or malware advisories).","commonSituations":"Custom audit registries with partial advisory metadata; npm advisory data gaps for unfixable/malware entries; older pnpm versions with less robust id derivation.","solutions":["Run plain pnpm audit, locate the advisory in the output, and record it explicitly with pnpm audit --ignore <id>","Update pnpm — id derivation and ignore handling improve across versions","Fix or remove the affected dependency so the advisory no longer matters","Report the advisory to the registry so its GHSA reference is backfilled"],"exampleFix":"# before\npnpm audit --ignore-unfixable # throws if an advisory has no GHSA\n\n# after (ignore the specific advisory you saw in the report)\npnpm audit --ignore GHSA-xxxx-xxxx-xxxx","handlingStrategy":"validation","validationCode":"const unfixableWithoutGhsa = Object.values(auditReport.advisories)\n  .filter(a => !hasResolutions(a) && !a.github_advisory_id)\n\nif (opts.ignoreUnfixable && unfixableWithoutGhsa.length > 0) {\n  const names = unfixableWithoutGhsa.map(a => `${a.module_name} (${a.id})`).join(', ')\n  throw new Error(`cannot --ignore-unfixable: advisories lacking a GHSA id: ${names}. Ignore them explicitly or update the dep.`)\n}","typeGuard":"interface AdvisoryWithGhsa { github_advisory_id: string }\n\nfunction hasGhsaId (a: { github_advisory_id?: string | null }): a is AdvisoryWithGhsa {\n  return typeof a.github_advisory_id === 'string' && a.github_advisory_id.length > 0\n}","tryCatchPattern":"try {\n  const ignored = await ignore(opts)\n} catch (err) {\n  if ((err as PnpmError).code === 'AUDIT_MISSING_GHSA') {\n    // fall back to explicit ignoring after inspecting the report\n    console.error('Run plain pnpm audit, note the advisory, then use pnpm audit --ignore <id>')\n    process.exitCode = 1\n    return\n  }\n  throw err\n}","preventionTips":["Prefer explicit --ignore <GHSA> over blanket --ignore-unfixable when advisory data may be incomplete","Fix or remove unfixable dependencies instead of ignoring them long-term","Keep pnpm updated to benefit from improved advisory id derivation"],"tags":["audit","advisory","ghsa","config"],"backgroundTag":null,"analyzedSha":"5b11d3a15b9022a2109cb18ed96a5d652630371f","analyzedAt":"2026-08-16T13:18:59.198Z","schemaVersion":2},"datasetVersion":"2026-08-16T18:17:16.020Z"}