yarn audit doesn't report vulnerable dependencies in a yarn workspace package

[gdamjan]

Do you want to request a feature or report a bug?

bug

What is the current behavior?

yarn audit doesn't report vulnerable dependencies in a yarn workspace package, even though the vulnerable package is listed in yarn.lock

If the current behavior is a bug, please provide the steps to reproduce.

make a repo using yarn workspaces, add minimatch@3.0.0 as a dependency in one of the workspaces, run yarn install and yarn audit

Here's an example repo that reproduces the issue:
https://github.com/gdamjan/yarn-audit-workspaces-example

What is the expected behavior?

yarn audit should report the vulnerability of a dependency listed in yarn.lock

Please mention your node.js, yarn and operating system version.

damjan docker $ node --version
v8.12.0
damjan docker $ yarn --version
1.12.1
damjan docker $ cat /etc/os-release 
NAME="Arch Linux"

[gdamjan]

$ yarn audit
yarn audit v1.12.1
0 vulnerabilities found - Packages audited: 0
Done in 1.20s.

it's interesting that github did recognize the vulnerability

[arcanis]

Ping @rally25rs?

[rally25rs]

Looks like this ends up happening because the root package doesn't have a real dependency on it's workspaces.

If the root workspace is named yarn-test and has:

{
  "name": "yarn-test",
  "version": "1.0.0",
  "main": "index.js",
  "license": "MIT",
  "private": true,
  "dependencies": {},
  "workspaces": ["packages/*"]
}

and a single workspace package packages/prj1

then what we send to the npm api is:

{
  "name": "yarn-test",
  "version": "1.0.0",
  "install": [],
  "remove": [],
  "metadata": {},
  "requires": {},
  "dependencies": {
    "prj1": {
      "version": "0.0.0",
      "integrity": "",
      "requires": {
        "minimatch": "3.0.0"
      },
      "dependencies": {}
    },
...etc

the "requires": {}, hash needs to include all the workspace packages (prj1 in this example).

[gdamjan]

what is cat-bug?

[rally25rs]

@gdamjan "category - bug". It's just a tag we use to track what issues are confirmed bugs, which are feature requests, etc.