Use "--omit=dev" internally on newer npm version

package.json

@@ -32,13 +32,15 @@
     "commander": "^8.0.0",
     "dayjs": "^1.10.6",
     "lodash.get": "^4.4.2",
+    "semver": "^7.3.8",
     "table": "^6.7.1"
   },
   "devDependencies": {
     "@types/chai": "^4.2.19",
     "@types/lodash.get": "^4.4.6",
     "@types/mocha": "^8.2.3",
     "@types/node": "^16.0.0",
+    "@types/semver": "^7.3.13",
     "@types/sinon": "^10.0.2",
     "@typescript-eslint/eslint-plugin": "^4.28.2",
     "@typescript-eslint/parser": "^4.28.2",

src/handlers/handleInput.ts

@@ -1,8 +1,23 @@
 import get from 'lodash.get';
+import semver from 'semver';
 import { AuditLevel, CommandOptions } from 'src/types';
+import { getNpmVersion } from '../utils/npm';
 import { readFile } from '../utils/file';
 import { getExceptionsIds } from '../utils/vulnerability';
 
+/**
+ * Get the `npm audit` flag to audit only production dependencies.
+ * @return {String} The flag.
+ */
+function getProductionOnlyOption() {
+  const npmVersion = getNpmVersion();
+  if (semver.satisfies(npmVersion, '<=8.13.2')) {
+    return '--production';
+  } else {
+    return '--omit=dev';
+  }
+}
+
 /**
  * Handle user's input
  * @param  {Object} options     User's command options or flags
@@ -13,7 +28,7 @@ export default function handleInput(options: CommandOptions, fn: (T1: string, T2
   const auditCommand: string = [
     'npm audit',
     // flags
-    get(options, 'production') ? '--production' : '',
+    get(options, 'production') ? getProductionOnlyOption() : '',
     get(options, 'registry') ? `--registry=${options.registry}` : '',
   ]
     .filter(Boolean)

src/utils/npm.ts

@@ -0,0 +1,11 @@
+import { exec } from 'child_process';
+import { Readable } from 'stream';
+
+/**
+ * Get the current npm version
+ * @return {String} The npm version
+ */
+export function getNpmVersion(): string {
+  const version = exec('npm --version');
+  return (version.stdout as Readable).toString();
+}

test/handlers/flags.test.ts

@@ -92,7 +92,7 @@ describe('Flags', () => {
     it('should be able to set production mode from the command flag correctly', () => {
       const callbackStub = sinon.stub();
       const options = { production: true };
-      const auditCommand = 'npm audit --production';
+      const auditCommand = 'npm audit --omit=dev';
       const auditLevel = 'info';
       const exceptionIds: string[] = [];