feat(audit): select which dependency groups to audit

[tommilligan]

Summary

Closes #6632.

Currently yarn audit shows vulnerabilities for production, development and optional dependencies. It would be useful to only audit production dependencies, or select which groups of dependencies to audit.

Test plan

master

$ yarn audit --prod
...
9 vulnerabilities found - Packages audited: 31177
Severity: 9 Low
Done in 2.24s.

this PR

$ yarn audit --groups dependencies
...
0 vulnerabilities found - Packages audited: 442
Done in 2.08s.

---

I look forward to hearing some feedback!

[Jalle19]

Looks like a pragmatic solution to me (commenting here mostly to get notified if this moves forward)

[syrnick]

Very helpful!

[Jalle19]

Any updates on this?

[charrondev]

Are any of the maintainers going to chime in here? Without this it is difficult to run audits in CI. My team is not going to stop the world because of a low severity DoS in our test runner for example. We do want to stop the world and fix a higher severity issue in a package shipped to production however.

[iflp]

@arcanis - please take a look at this, thanks!

[arcanis]

Ping @rally25rs ?

[rally25rs]

Sorry for the long delay. Thanks for the contribution! 🎉

[rally25rs]

@tommilligan it looks like some of the audit unit tests now fail due to another change to audit that adds whether or not it is a dev dep. Would you mind resolving the failing tests? (or I'll see if I can push a commit to fix it...)

---

Edit:

Never mind, I figured out how to push a commit. Github really doesn't like to make it obvious 😆

[OZZlE]

Seems like a great idea but doesn't seem to work, it's complaining about devDepencencies anyway

I tried both yarn audit --prod and yarn audit --groups dependencies it still reports devDepencencies