fix(security): require audit severity values

scripts/pre-commit/pnpm-audit-prod.mjs

@@ -913,22 +913,29 @@ export async function runPnpmAuditProd({
   return 1;
 }
 
-function parseArgs(argv) {
+function readSeverityValue(value, optionName) {
+  if (value === undefined || value === "" || value.startsWith("--")) {
+    throw new Error(`${optionName} requires a value`);
+  }
+  return value;
+}
+
+export function parseArgs(argv) {
   let minSeverity = MIN_SEVERITY;
 
   for (let index = 0; index < argv.length; index += 1) {
     const argument = argv[index];
     if (argument === "--audit-level" || argument === "--min-severity") {
-      minSeverity = argv[index + 1] ?? "";
+      minSeverity = readSeverityValue(argv[index + 1], argument);
       index += 1;
       continue;
     }
     if (argument.startsWith("--audit-level=")) {
-      minSeverity = argument.slice("--audit-level=".length);
+      minSeverity = readSeverityValue(argument.slice("--audit-level=".length), "--audit-level");
       continue;
     }
     if (argument.startsWith("--min-severity=")) {
-      minSeverity = argument.slice("--min-severity=".length);
+      minSeverity = readSeverityValue(argument.slice("--min-severity=".length), "--min-severity");
       continue;
     }
     throw new Error(`Unknown argument "${argument}".`);

test/scripts/pnpm-audit-prod.test.ts

@@ -8,6 +8,7 @@ import {
   createBulkAdvisoryPayload,
   fetchBulkAdvisories,
   filterFindingsBySeverity,
+  parseArgs,
   parseSnapshotKey,
   readBoundedBulkAdvisoryErrorText,
   runPnpmAuditProd,
@@ -15,6 +16,19 @@ import {
 } from "../../scripts/pre-commit/pnpm-audit-prod.mjs";
 
 describe("pnpm-audit-prod", () => {
+  it("parses explicit audit severity flags", () => {
+    expect(parseArgs(["--min-severity", "critical"])).toEqual({ minSeverity: "critical" });
+    expect(parseArgs(["--audit-level=moderate"])).toEqual({ minSeverity: "moderate" });
+  });
+
+  it("rejects missing audit severity flag values", () => {
+    expect(() => parseArgs(["--min-severity"])).toThrow("--min-severity requires a value");
+    expect(() => parseArgs(["--min-severity", "--audit-level", "critical"])).toThrow(
+      "--min-severity requires a value",
+    );
+    expect(() => parseArgs(["--audit-level="])).toThrow("--audit-level requires a value");
+  });
+
   it("parses scoped snapshot keys with peer suffixes", () => {
     expect(parseSnapshotKey("@scope/pkg@1.2.3(peer@4.5.6)")).toEqual({
       packageName: "@scope/pkg",