[Feature] yarn npm audit: report unused npmAuditIgnoreAdvisories entries #7325

• I'd be willing to implement this feature (contributing guide)
• This feature is important to have in this repository; a contrib plugin wouldn't do

Describe the user story

As a maintainer of a project that ignores some advisories via npmAuditIgnoreAdvisories, I want to find out when an entry is no longer needed.

Ignore entries are added to get a green yarn npm audit while a vulnerable or deprecated transitive dependency can't be updated yet. Once the dependency is updated, the entry silently stays in .yarnrc.yml. Nothing tells us that it can be removed, so the list only grows, and it keeps hiding the advisory if the vulnerable version ever comes back.

Today we work around this in CI with a script that copies the project to a temp directory without the npmAuditIgnoreAdvisories setting, runs yarn npm audit --recursive --json there, and checks which of our ignore entries do not show up in the output anymore. Yarn already knows this while filtering, so the workaround feels like it should not be necessary.

Describe the solution you'd like

A new flag for yarn npm audit, for example --report-unused-ignores (name is open), that additionally reports the ignore patterns (from npmAuditIgnoreAdvisories and --ignore) that did not match any advisory of the audit result.

In packages/plugin-npm-cli/sources/commands/npm/audit.ts the result of the registry request is filtered with micromatch.isMatch(${advisory.id}, ignoredAdvisories). The flag would check each ignore pattern against the advisory ids of the unfiltered result (including the synthetic <package> (deprecation) ids) and print the patterns that matched nothing. Possible behavior:

• The unused patterns are printed (also in the --json output), e.g. as a warning.
• With the flag, the command exits with a non-zero code if there are unused patterns, so that a CI job can fail or mark itself unstable. Whether this should be a separate exit code is open.
• Without the flag nothing changes.

I have a working prototype with tests (and a changeset) here, in case you want to look at the concrete behavior before deciding on the name of the flag or the exit code: master...tinobino:berry:feat/npm-audit-unused-ignores

It is not a PR yet; I'll open one once we agree on the details.

Describe the drawbacks of your solution

• A new option to maintain on a command that otherwise has a small surface.
• A pattern is considered used only relative to the audit that was run. Options that change the result (--environment, --exclude, --all, --recursive, --severity) can make an ignore look unused although it is needed in another run. The report should say that it is about this run only. Severity filtering is applied after the ignore matching and would not need to be considered.
• Glob patterns that match several advisories count as used if at least one matches.
• Advisory data comes from the registry, so the result can differ between runs, e.g. when a registry has not published an advisory yet.

Describe alternatives you've considered

• A script outside of Yarn, as described above. It works but has to rebuild a project copy and parse JSON output, and it can't see which ignore entry matched.
• A contrib plugin: the plugin API does not give access to the audit result inside the npm audit command, so a plugin would have to duplicate the whole command.
• Showing unused ignores by default as a warning, without a flag. That changes the output of existing setups, so I would not propose it.