feat(audit): add filtering by severity level

[rogeriopvl]

Summary

This pull request implements the feature requested in #6668.

It basically adds a --level flag to the audit command allowing to filter the audit output by severity greater than or equal to the provided value which can be (info, low, moderate, high or critical).

Test plan

Example:

yarn audit --level high

This outputs all advisories ranked high and critical.

By default without this new flag, the audit command will behave as it always did.

[rogeriopvl]

appveyor is failing on an unrelated test 🤔

[ghamaide]

any updates on this PR? It would help a lot :-)

[buildsize]

File name	Previous Size	New Size	Change
yarn-[version].noarch.rpm	1.11 MB	1.1 MB	-2.34 KB (0%)
yarn-[version].js	4.47 MB	4.47 MB	-3.32 KB (0%)
yarn-legacy-[version].js	4.66 MB	4.66 MB	-3.69 KB (0%)
yarn-v[version].tar.gz	1.12 MB	1.11 MB	-1.92 KB (0%)
yarn_[version]all.deb	815.75 KB	814.58 KB	-1.17 KB (0%)

[rogeriopvl]

@rally25rs fixed :)

[rally25rs]

@rogeriopvl looks like there are some merge conflicts now due to another PR that touched audit.js. Would you mind taking a look into resolving these? Then I'll get this merged in. Sorry for the delay.

[rogeriopvl]

@rally25rs Should be good now

[amitrai99]

I'm on yarn version v1.13.0 and using the filter param does not do anything. I can see issues with all severity levels in the report.

yarn audit --level high

or

yarn audit --level=high

both don't do anything for filtering.

[MrJadaml]

Also not seeing output get filtered when using the --level flag.

In the mean time I am using the following command:
yarn audit | grep -A 12 [LEVEL]
i.e.
yarn audit | grep -A 12 high

[robertlagrant]

I have the same problem - here it is running in a Docker build:

Step 9/28 : RUN yarn audit --level high
 ---> Running in 13868852e5e2
yarn audit v1.19.1
63 vulnerabilities found - Packages audited: 37010
Severity: 63 Low
Done in 1.79s.
The command '/bin/sh -c yarn audit --level high' returned a non-zero code: 2

[hkdobrev]

Both the --level and --group filters do not do anything anymore. I'm on Yarn version 1.22.10.