npm-audit-resolver | A tool for building a responsible but practical supply

npm-audit-resolver is a JavaScript library. npm-audit-resolver has no bugs, it has no vulnerabilities, it has a Permissive License and it has low support. You can install using 'npm i npm-audit-resolver' or download it from GitHub, npm.

A tool for building a responsible but practical supply chain security practice. npm audit is great. npm audit fix is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use. I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. Audit resolver creates a audit-resolve.json file in your app and interactively helps you manage security of your dependencies. You can decide what to ignore and for how long, or track what's been fixed before. The audit-resolve.json file sits in the repository and you can see who decided to ignore what and when. I'm working on getting it built into npm. See the RFC I'm participating in Package Vulnerability Management & Reporting Collaboration Space where I intend to donate parts of the audit-resolver's core.