better-npm-audit
better-npm-audit copied to clipboard
Target specific package versions in --module-ignore
It would be very handy for us if we could target specific package versions in the --module-ignore flag so that we don't have to come back and manually update our whitelists once we update problematic package versions. For example:
1. We have included package_A v1.2.3.
2. better-npm-audit audit -l high fails because of an issue with a subpackage of package_A v1.2.3.
3. We exclude it using better-npm-audit audit -l high -m package_A
4. Later, we update package_A to v1.2.4.
5. A new advisory is created for a package_A v1.2.4, but our audits continue to pass because we excluded package_A in our pipeline.
hey @knightsg, thanks for the suggestion, definitely a good idea 👍🏻 let me look into this as soon as I get time, but feel free to open a PR :)