package.advisory

An advisory is against a declaration of an installed package that the app reaches.

Area 14, Tooling; not declinable; the next step is usually the human's.

Why Jadpo refuses it

An advisory names declarations and versions, such as Postcodes.uk.parse, 2.0.0 to 2.1.2, rather than a whole package, so jadpo package audit can say whether your app's own code gets to the declaration, directly or through what the package calls itself. Code reached only from a test doesn't count. One the app reaches fails the command, so CI stops on it; one it doesn't reach is listed and doesn't. An app with errors has no whole picture of what it reaches, so every advisory counts until they are fixed.

audit is the one check that goes online: jadpo check and jadpo build never do.

What it looks like

The app calls Postcodes.uk.parse, and the installed 2.0.0 has an advisory against it:

jadpo package audit

(human) at the end of the next: line tells your coding agent to stop and ask you which fix you want, because the choice is yours to make: it decides whose code your app runs.

How to fix it

If a release fixes it, take it. One marked urgent is taken at once, and any other waits its three days unless you name it:

jadpo package update postcodesjadpo package update postcodes --to 2.1.3

The next jadpo package audit no longer lists it, since the advisory is against the versions before the fix.

If no release fixes it yet, copy the package into your own integrations, in the same format, and fix it there:

cp -R packages/postcodes shared/providers/postcodesjadpo package remove postcodes

It is then the app's own code, and yours to change.

Related

• Yanks, takedowns and advisories
• Installing and updating from the registry