Yarn audit does not work with an external repository

[adamscybot]

Do you want to request a feature or report a bug?
Bug

What is the current behavior?

When running yarn audit with the --registry flag, it uses the main yarn repo anyway.

If the current behavior is a bug, please provide the steps to reproduce.

Execute yarn audit --registry https://registry.npmjs.org/

What is the expected behavior?

Audit calls are made to the defined registry. This is especially important for everyone with third party repo's where the outside world it blocked on CI agents. Or if you're using some kind of proxy.

Please mention your node.js, yarn and operating system version.

Mac Os Mojave
Yarn 1.13.0
Node 10.15.1

[abhisheksoni27]

What exactly is happening on LINE 217 ?

yarn/src/cli/commands/audit.js

Lines 211 to 225 in 0f05203

	async _fetchAudit(auditTree: AuditTree): Object {
	let responseJson;
	const registry = YARN_REGISTRY;
	this.reporter.verbose(`Audit Request: ${JSON.stringify(auditTree, null, 2)}`);
	const requestBody = await gzip(JSON.stringify(auditTree));
	const response = await this.config.requestManager.request({
	url: `${registry}/-/npm/v1/security/audits`,
	method: 'POST',
	body: requestBody,
	headers: {
	'Content-Encoding': 'gzip',
	'Content-Type': 'application/json',
	Accept: 'application/json',
	},
	});

Do you have an endpoint configured that automatically calls npm's audit registry ?

[gaiazov]

@abhisheksoni27 on line 217 the YARN_REGISTRY constant is used, which corresponds to https://registry.yarnpkg.com

yarn/src/constants.js

Line 21 in 0f05203

export const YARN_REGISTRY = 'https://registry.yarnpkg.com';

[pratyushj]

Hey, can I try to solve this bug?

[eugenesimakin]

Hi @pratyushj, the issue already has its PR #7263. Thanks!
In addition to that, it has a duplicate PR #6484

[MadaraUchiha]

This is still open in 2022, any update on this?

[GeorgeWL]

any update? still seeing this in March 2022

[GodOfCoding1]

Hi , Is this still open in 2022?

[srcimon]

Still open in 2023.

[M1chael]

Greetings from 2k24.

[superblangel]

Hello from 2025