[AaronFriel]

For those hoping to run npm audit in your CI/CD pipeline, I recommend this tool from IBM: https://github.com/IBM/audit-ci

In highly regulated industries, shipping code flagged as having a vuln without a manual approval could be a liability.

This wrapper around npm takes an allowlist argument, and our procedure is for an engineer to review the failing build, determine if the vulnerability (ugh, usually regex ddos or prototype pollution) is present in code that runs only at build time with trusted inputs, only on the client which is by definition untrusted, or in our webserver which takes in untrusted input.

As long as it's either of the first two, we document it in a commit and comment and redeploy. It's annoying, but it's far better than npm audit forcing a fix.

[naugtur]

Compare with npm-audit-resolver in terms of how the ignores are defined. It's important to not be too vague when ignoring things.

Let me plug this as it contains a lot of references https://dev.to/naugtur/do-you-need-help-with-your-npm-audit-...

Meanwhile I'll try to get someone from IBM involved in the OpenJSF collab space