pnpm/pnpm · error · PnpmError

AUDIT_MISSING_GHSA

AUDIT_MISSING_GHSA

Error message

Cannot ignore advisory ${advisory.id} (${advisory.module_name}): the registry did not provide a GHSA id or a resolvable url.

What it means

With --ignore-unfixable, pnpm auto-records advisories that have no resolutions into the ignore list, keyed by GHSA id (normalized to uppercase). An advisory that carries neither github_advisory_id nor a resolvable url has no stable key to store, so ignore() throws AUDIT_MISSING_GHSA instead of silently dropping it.

Source

Thrown at pnpm11/deps/compliance/commands/src/audit/ignore.ts:29

  auditReport: AuditReport
  rootProjectManifest?: ProjectManifest
  rootProjectManifestDir: string
  workspaceDir: string
  auditConfig?: AuditConfig
}

export async function ignore (opts: IgnoreVulnerabilitiesOptions): Promise<string[]> {
  // GHSA IDs are canonically uppercase; normalize on read/write so a stored
  // "ghsa-..." or uppercase user input both match the derived id at filter
  // time.
  const currentGhsas = (opts?.auditConfig?.ignoreGhsas ?? []).map(normalizeGhsaId)
  const currentUniqueGhsas = new Set(currentGhsas)
  const advisoriesWithNoResolutions = filterAdvisoriesWithNoResolutions(Object.values(opts.auditReport.advisories))

  if (opts.ignoreUnfixable) {
    for (const advisory of advisoriesWithNoResolutions) {
      if (!advisory.github_advisory_id) {
        throw new PnpmError(
          'AUDIT_MISSING_GHSA',
          `Cannot ignore advisory ${advisory.id} (${advisory.module_name}): the registry did not provide a GHSA id or a resolvable url.`
        )
      }
      currentUniqueGhsas.add(normalizeGhsaId(advisory.github_advisory_id))
    }
  } else if (opts.ignore) {
    for (const ghsa of opts.ignore) {
      currentUniqueGhsas.add(normalizeGhsaId(ghsa))
    }
  }

  const newIgnoreGhsas = currentUniqueGhsas.size > 0 ? Array.from(currentUniqueGhsas) : undefined
  const diffGhsas = difference(newIgnoreGhsas ?? [], currentGhsas)
  await writeSettings({
    ...opts,
    updatedSettings: {
      auditConfig: {

View on GitHub (pinned to 5b11d3a15b)

Solutions

1. Run plain pnpm audit, locate the advisory in the output, and record it explicitly with pnpm audit --ignore <id>
2. Update pnpm — id derivation and ignore handling improve across versions
3. Fix or remove the affected dependency so the advisory no longer matters
4. Report the advisory to the registry so its GHSA reference is backfilled

Example fix

# before
pnpm audit --ignore-unfixable # throws if an advisory has no GHSA

# after (ignore the specific advisory you saw in the report)
pnpm audit --ignore GHSA-xxxx-xxxx-xxxx

const unfixableWithoutGhsa = Object.values(auditReport.advisories)
  .filter(a => !hasResolutions(a) && !a.github_advisory_id)

if (opts.ignoreUnfixable && unfixableWithoutGhsa.length > 0) {
  const names = unfixableWithoutGhsa.map(a => `${a.module_name} (${a.id})`).join(', ')
  throw new Error(`cannot --ignore-unfixable: advisories lacking a GHSA id: ${names}. Ignore them explicitly or update the dep.`)
}

interface AdvisoryWithGhsa { github_advisory_id: string }

function hasGhsaId (a: { github_advisory_id?: string | null }): a is AdvisoryWithGhsa {
  return typeof a.github_advisory_id === 'string' && a.github_advisory_id.length > 0
}

try {
  const ignored = await ignore(opts)
} catch (err) {
  if ((err as PnpmError).code === 'AUDIT_MISSING_GHSA') {
    // fall back to explicit ignoring after inspecting the report
    console.error('Run plain pnpm audit, note the advisory, then use pnpm audit --ignore <id>')
    process.exitCode = 1
    return
  }
  throw err
}

When it happens

Trigger: pnpm audit --ignore-unfixable when the registry's advisory data for an unfixable package lacks a GHSA reference — a data gap on the registry side (some older or malware advisories).

Common situations: Custom audit registries with partial advisory metadata; npm advisory data gaps for unfixable/malware entries; older pnpm versions with less robust id derivation.

Related errors

• AUDIT_ENDPOINT_NOT_EXISTS
• PATCH_FILE_PATH_MISSING
• INVALID_CATALOGS_CONFIGURATION
• CONFIG_NO_SUBCOMMAND
• CONFIG_NO_PARAMS

AI-assisted analysis of pnpm/pnpm@5b11d3a15b (2026-08-16). Data as JSON: /api/errors/8c98146fd47ebf22. Report an issue: GitHub.