[xmprt]

Instead of marking dependencies as safe by the developer or by the end user, I wonder if the immediate parent can mark it as safe (because it has the appropriate context) and then npm audit can avoid reporting that "vulnerability" when it sees it.