lennym / ciaudit Goto Github PK

As a developer, I would like to ignore dev dependencies for the purposes of security vulnerability audits.

In the output of npm audit --json in the advisories[<num>].findings.dev key, we can tell if an advisory is related to a prod dependency or not. It would be useful to be able to have a command-line argument to enable/disable CI failures on dev dependencies. For example:

npx @lennym/ciaudit --level moderate --ignore-dev