Skip to main content

pnpm track

Tool version: 11.25.0. Runtime: Node 22.17.1 (used for application tests even with Bun). Scanner: CVE Lite 1.40.0.

Setup​

From the exported kit root, open a terminal and run cd app. In the source repository, enter this track's student folder instead. Every command below is run from that application directory.

npm install -g pnpm@11.25.0

Use student/ in the source repository or app/ in a distributed student kit. Start a terminal inside that directory; do not scan the catalog root.

pnpm install --frozen-lockfile --ignore-scripts
node --test
node src/app.mjs
pnpm why follow-redirects
npm exec --yes --package=cve-lite-cli@1.40.0 -- cve-lite . --json --all --no-open

Expected application output: Security has 2 registrations, Web has 1; URL is https://example.invalid/report?course=Security. No request is sent.

Only one manager lockfile belongs in this folder.

Use the exercise worksheet to investigate before making changes. Generated JSON reports are written in your current directory; preserve each scan under a distinct filename. A successful scan does not automatically mean zero vulnerabilities: inspect status, complete and findingCount.

Making a reviewed change​

Before editing, copy package.json and the lockfile to a separate evidence folder using your editor or file manager. You can then compare before and after without needing Git. If you use Git, git diff -- package.json and git diff -- LOCKFILE show changes after a baseline commit; replace LOCKFILE with this track's actual filename.

Use this syntax after you have selected a version from the scan and verified it against advisory evidence. PACKAGE and VERSION are placeholders, not literal text to run:

pnpm add --save-exact --ignore-scripts PACKAGE@VERSION

You may specify multiple reviewed PACKAGE@VERSION arguments. The --ignore-scripts flag disables sample lifecycle scripts. Do not use another manager or delete the lockfile to force a pass. Keep the approval step with your instructor; for self-study, record your reasoning before executing.

After applying the change, run node --test, node src/app.mjs and the same scan command again. Open the timestamped JSON file in your editor. Save copies as before.json and after.json in your evidence folder, and record status, complete and findingCount. These names are your saved evidence, not special scanner options.

Screenshot preview