{"_id":"npm-audit-resolver","_rev":"53-74682deb0ae0fb2cdc2a54979b5a1e90","name":"npm-audit-resolver","dist-tags":{"latest":"3.0.0-RC.0","next":"3.0.0-9"},"versions":{"1.0.0":{"name":"npm-audit-resolver","version":"1.0.0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"test":"node index.js"},"keywords":["npm","audit","security","dependencies","nsp","check"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"concat-stream":"^1.6.2","flatten":"^1.0.2","inquirer":"^5.2.0","promptly":"^3.0.3","spawn-shell":"^2.0.1"},"devDependencies":{"base64url":"^2.0.0","lodash":"^2.0.0"},"gitHead":"9ce973eb379b195c3614e411922c051eb4a1012c","_id":"npm-audit-resolver@1.0.0","_npmVersion":"6.1.0-next.0","_nodeVersion":"8.11.1","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-yks7aAVHj5wHdyh6LmwytMqGGOa1ekaIh+DOR910ZnkMtBRSeWRhF17OjbpW/GsFAF+xDGuDMudvb+IW34Pasg==","shasum":"58d27dc587a4e4b064f8c4b5fd858ddade01bd07","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.0.0.tgz","fileCount":12,"unpackedSize":39209,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbBof8CRA9TVsSAnZWagAAYi0P/iro++3zdAj4XG8TA9zF\njyKaXmYOmPeaahcCCXiUMf4aY+X0VeSaHvjL2IkYaAiC/dsJSHsvWIhNAajW\ngpFjpdrxQ2SN7+PcTHykiBDWKgrTj74ejPD615FOPVDaQN60530HD7Ze5XoU\nur0CFW6GYwQBV8zueIZ219yiwlNnPDPLiz+p1pSR4goKX5vUURKtLjS7LyY6\nC/OoiGefA/8dsNHRNZ093PBN5tBldeaASt3bDIP6U1bYgtB2/UhoKJdzFaPv\n0Z6wb2ObJhDtahhyONlA3aRz/MsC9msXAc+sILTR0mQ1mz24/Lbg3q7yjDXE\n7KnIALYusnthjpZ9ON0zfSEA2IA0aOV8BNJC5AfQ/P3Y1JesakArH+JTfWE1\nIXcRsE6n6DnVFiP6r7JFM6I50QO6EFIHIh3fUHcZb8ZHdcMR5N56ptvZlQYI\njPuTIQh6ZYmdFL96xkJSdG9c5a6qzWCZbN0B3m8s3nyg4DVlt2WCduIUjj7Z\n0MDDRT/J63sFkrKMJCHa1EkZNBJeJ1gMs6awpwg7G4apICY1bD/Se2kH/VPA\nv8s+KoWZVzeyGBR1j1CC+mIG7eyEUjPL9cUOiKlbLwLD00KqsPV3/lnpoYfn\nWN/u+PCyX2xiCjKkicNoeMy4lYacz7Wq9qM7+cCf00rt3trF7zgoD4xuvdn1\noJ58\r\n=XxQ1\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDI+GgqmAe0Yg9fHsx53MHCDucp+ROXnX2xFx6SdLQpsgIgL+/PvUE9n+/HsnrWzuLa0b/wedy9W3XQOdRBKxnp0WM="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.0.0_1527154684127_0.7394817909834761"},"_hasShrinkwrap":false},"1.0.1-0":{"name":"npm-audit-resolver","version":"1.0.1-0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"test":"node index.js"},"keywords":["npm","audit","security","dependencies","nsp","check"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"concat-stream":"^1.6.2","flatten":"^1.0.2","inquirer":"^5.2.0","promptly":"^3.0.3","spawn-shell":"^2.0.1"},"devDependencies":{"base64url":"^2.0.0","lodash":"^2.0.0"},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Running in CI\n\nOne if the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun \n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\n## Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"2e62d0d8c60860e178aa66f01a45343705eb5cc0","_id":"npm-audit-resolver@1.0.1-0","_npmVersion":"6.1.0","_nodeVersion":"8.11.1","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-xla3draLd9zKstxCqLDgxNkhfHDn1sY5C2vBd9V2RIYoVjn883VZ6/q8bt0toJso38E7PUbTtyC6Kg0GuiqyCQ==","shasum":"ebff23fc85ad214d92468e5d01e04c27e2093fdc","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.0.1-0.tgz","fileCount":12,"unpackedSize":39622,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbBpMNCRA9TVsSAnZWagAA4xMQAKOkOf9ZQIKR/GtRV3iv\neiWOU0+mfVSkl3wsMe4OYWUfo+UOYL89Dv7eY2uX68zRFHYvozXGGGYhz/W5\nH3/h+z03NybqUbixpBw+5+3rApJ2FvCUdYDFjIviD3YqJqWmU+tVsW0KpkZw\nAa7n+TP3P0P4oFRKsqIyEWprr3VR4yjOoYVcRe2HKycBLtg9RON2jB9Q+ojj\nZvNzDGy4+NyOyJER4fncJyghRYFlDmopbzP/7n82FAv6XGkAOE8p8ccCiOls\nnyXVvRAXeqBdaXvCd/l8j1YBRGEciaL+5AlCIvKf/qcKWG/eQUQ8h7dn2Byp\nEMC+51WB10u6TFA6bNWIk6rqjJBO3H9DueisfRxVmDcPDJrt4YJQObU81qcJ\nS9thcsfpsHcQ0/n8rP3NmtvyhOOTivvBH4JykbIbf64fwZPlR+G1T6faLRx2\ncE4I+RcO2w0t2dDylPYIDcaYOe8HwgCrdx7vZ4li15zpJb61SSY4kqkMbM6p\nmsRFfuLcbmHCMl6WV7xI1OA/9c/FNZ4Zb9z2QRCTW1K48SRqlNYU+i1LyBoY\nAe3sOKldMQ4WJqU8fAxkhbEszohKNYp4CENagOuAla9IV6/rp1loWWbKr+mU\nQWlsaRm1WQch8/sw4phpF0/7eBaJYFA8V1yt50r+ruIymOOxjv1vB6qg3w0p\nOHvU\r\n=qsgi\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIESVkQQHby1M9gekS9XUN766yqbhDdxUQQG8rzFhp/3/AiBMa7tLuEhsWri7FIQZdyG7DdflSLFd/M5Id4U5pSIwUg=="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.0.1-0_1527157517033_0.49521426085935705"},"_hasShrinkwrap":false},"1.0.1":{"name":"npm-audit-resolver","version":"1.0.1","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0","rm-vulns":"npm rm -D base64url lodash","test":"npm run add-vulns && node index.js && node check.js && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","spawn-shell":"^2.0.1"},"devDependencies":{},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Running in CI\n\nOne if the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun \n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\n## Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"09899dbf1ead462eba16e1a3016368042eb7ef34","_id":"npm-audit-resolver@1.0.1","_npmVersion":"6.1.0","_nodeVersion":"8.11.1","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-XyWkKsXuqx1+8q2RzzHpqS3T5KbvHnfDufLDDaVjxBUv8ob6JstFbrRhYdJ7OsYVA7sKmX+JCqrU3IuZu+YJzA==","shasum":"9be3633cb3d4b9341bc93c06a511b19bb4ef462b","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.0.1.tgz","fileCount":11,"unpackedSize":24960,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbBp9ACRA9TVsSAnZWagAAHDEP/RSwSttlXiC4B3EC1evW\nGmqe8zjvBqvvokNPRXLePaGkbnMpKPDkCqqWgiJzc/wLtHb3PoxmO6bAUb9p\na8lMPGkMApLB6+iZyWTzVCGiDvFaBusMe+dyQvMw1UQ8bsCOhfhw8qPcv47T\nt3TjcanmMDp3hDg12dyhwPRLBMKXTEwPU/MXUW/hAB7pg6ckR8hTjlVP1xFY\n9r+pCgdu/vwF6rhIKJJ8P1GQ2VSFvOgA8UquZNEnDu1OZsZtaaIeIEumAzUY\ngneToV3ZrDky7G74n/nkxPLwu3nk5VvmcJzzo+eZjyLHsEDmG+BHmlrhtCRE\ns/vWVs3wbuOQYTS75ojSfVPzXzgPggsdSRLxRj+lPaPJ9Zo5bBCigAs3CnL6\ndoOf9ZtRq+VLhrAqfsaZgjq+9DcfcqQxKxj3+HgZmOs1vAGOjyTUOLXCdOtu\nth4NaUof9T6sNB8qMn3IYZs61w2IO/PmwoJGh1X50G9FgCoEaI5b3yJLy2Ko\nJotKivoQTWU61bniA7tBH1cq1o/4e+GeKzIpuLN1vu41nKwqo0+vvuAAAiCV\ni9wQ++rIooj0BC7Z/YCmUnEZaKcZ5LECuLpweGJmXg+M2ghBt4vn+xfhXnKD\ndyzHWrSGHDwxfWfZfBDHxEbgDWCqWPKgGNuEVbi8/3ERdc9fLPgO6ich7img\nbdkv\r\n=Vn4n\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIHhIQiKx14kwavK0imBwexNQfy2ghDVGcRBIfJ+QsBUuAiEAz+nBA2XI0piQ9XDJ0O9SCt1/IoEBlblJ3WNlGrt3X4U="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.0.1_1527160640226_0.1264279542477207"},"_hasShrinkwrap":false},"1.0.2":{"name":"npm-audit-resolver","version":"1.0.2","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0","rm-vulns":"npm rm -D base64url lodash","test":"npm run add-vulns && node index.js && node check.js && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","spawn-shell":"^2.0.1"},"devDependencies":{},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Running in CI\n\nOne if the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun \n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\n## Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"545b90b3c28e39b862f4897abcc7eaa854173263","_id":"npm-audit-resolver@1.0.2","_shasum":"85ae20d23a709856a7f2acd571d1b3bcaccaf94f","_from":".","_npmVersion":"3.10.10","_nodeVersion":"6.11.5","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"shasum":"85ae20d23a709856a7f2acd571d1b3bcaccaf94f","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.0.2.tgz","fileCount":13,"unpackedSize":31652,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbBqPECRA9TVsSAnZWagAA+jUP/1V1A0coP6Bqn0nInp6h\notftg2F60C1VpDVVPGqm1P5c0o61SGcR2t95vGJEdqyruXWBPwZenZggjGSj\nQgZ51XDCKVaCEu6FvAzfWnVXz9qoLmefiho6tlGfBIOCSR8VhSaNC2oL1rtk\nt2LtpOt+qzCTg1DxoQUR8rm9Q9UVQ+JB9kH24pw+z9bvu/pXqJjowCN0XQ8j\n1f1X7sTeDx/oazz2Amzo4qufnk3nfvk0225hX3rWjtyjzAFuUgbubMS8ip1z\n8hv+ZgxqxlOjPoWqxQUo9xmTVsSQGRu4JG2rSNuqQMLD+nlCbIWjq0QNACZb\nxOl5m7SqUA99xmMq+Gh31BmldTF6iIzKatw9xoOMIc4RahQVk3hkxrOy1ete\nLuy04sat6KMiN3BNKJeyeTMXvtrGpMH+F+7p0/mAZgjYEx4OzJmqoA8187Wl\nz+A0PoQzBTtYG3eAbhDJhIQRrRau/bUNdkRNJGVuLUqfCd1wBnVXiIWFDAXs\n94uWicT0rYglueFt6PQqqmLQyaS0bCwNNER0pdCC2qusH2eMraXw/l8eK/46\ns+L3Y2mfYDU4hkuc/wH0LhtKFB4/uBLWTWt/+L4U9+wGqjgbrYgGz9tzi0f7\nBCUDHNdsE4ZZcyCa3FbvaFmW2xdWObfk4DS0j0rXuHLY3GuyNl/Dyym36YSp\nD40d\r\n=rRt5\r\n-----END PGP SIGNATURE-----\r\n","integrity":"sha512-yJwRwPwnoUXYpPQmXaiAKL2rY8ZBSzX5Zb26X4mBzW2ma97htLD1OL1ilycuh/e0Six11yzpHLAnmt0d5w4cyQ==","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCID08MlmWJCsI2/rPzV/xRADrSeQeliXQjf++4uBSZdqKAiA/Y+eBRhhbCjVpzMeyLZt1UFqiUXxaSlxSv2/Z7+YeJg=="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.0.2_1527161796123_0.5472154494818675"},"_hasShrinkwrap":false},"1.1.0":{"name":"npm-audit-resolver","version":"1.1.0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0","rm-vulns":"npm rm -D base64url lodash","test":"npm run add-vulns && node index.js --ignoreLow && node check.js && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{"base64url":"^2.0.0","lodash":"^2.0.0"},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n** This is experimental, built in a few hours. When using this software you are still responsible for the security of your app **\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n```\n\n### Running in CI\n\nOne if the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\n## Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"81bbc9dd8e72e0cd02a7af951061b6f545988b36","_id":"npm-audit-resolver@1.1.0","_npmVersion":"6.1.0","_nodeVersion":"8.11.1","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-ubTIukAy8Pmt7Ds4N3zeZgpfUI9W59CczA18CJaNKF8I7M7cKXLn6p8hhugh6Oi0S1S0MnBSq9SKZ1GdahDb6w==","shasum":"71038296650d13a9b8d38dee895171a63dd3ca82","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.1.0.tgz","fileCount":13,"unpackedSize":29056,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbFQr7CRA9TVsSAnZWagAAj5oP/RGNZQfNsWZ73u010wrH\nzlXVt1tErX6HdIRjSiEJzyGkk8Que6uthA+/l64SQmD7MKWXi+gUadkZxau0\new4z1Z3CKr/YGh0T11rp8t4ZZqLVy7FVyIMJhpugR1A/8ry0YIuYdn96RaEP\nhUg0fmjG8tsCX3p75PsGIVmrvv6HiLbGJvcgohprzAfJ9AiGZeDebbpY0xZ+\nD1eO5s8pEIntFL0jVzehax7kpTKQ4pJKN2J+0leuAs/uOvShpcRNpccE5k/X\nUaLL27P/GFEKg6azzAsFJBTBPI/shUyas6GKJdlCkbakGigg5v0Px79uLFUI\noXKUdqiLkIYYLbDvuaoTlEB4CyuX7XImAQezUkh7+hSML2ROh3dIfeKU+Kb/\nZpKO1Zg70zmG66DN3DPkeOVt0/+dfskRmLiTDU4NfzyHcYDFPkbS8N68O5U1\nz0EaHs+EN81pxPcw+tcadG0DZh+OVT+4bxw9T2ZMvvKYzWNNo4Fe8B1tOsjY\nHM1i+djLfOIasYu+CBt2nMAf6pRlcZiNHdIdy5C7ESOBVi3T+mdzZS9KqUOm\n8VePEdFdkeE7a6QMmxfps1oIRvercrY3f9gZk3Qq+pWyGLKEDz7Let+lfCIW\nUJVlCMi3HTXOqWnvcO1gaYOvBWQWmPMGpNLK/We6hzQ5Vw50FLJrZTPGsN0O\nBJ2k\r\n=YicW\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCICOvVSNLw2bbVxdRReVSfljch3V061wnRAGzhiCzPxwTAiBeiOkkCELHCpjHJ1/axVUNhGIdqfWQeQlOVNT0EQbqbQ=="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.1.0_1528105723218_0.944605144601153"},"_hasShrinkwrap":false},"1.1.1":{"name":"npm-audit-resolver","version":"1.1.1","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0","rm-vulns":"npm rm -D base64url lodash","test":"npm run add-vulns && node index.js --ignoreLow && node check.js && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{"base64url":"^2.0.0","lodash":"^2.0.0"},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n** This is experimental, built in a few hours. When using this software you are still responsible for the security of your app **\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n```\n\n### Running in CI\n\nOne if the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\n## Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"f1a2da18262ba717f9ebf54f9085bf00bc5adcc8","_id":"npm-audit-resolver@1.1.1","_npmVersion":"6.1.0","_nodeVersion":"6.11.5","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-o6ePxQ+bRaa3XqUzlr6ztPgbS2CkzkXCoUl+CmJvo+U4B2GzAL425BszYg7f1RyV4Lm/sn37KSxjJrh2O5Eflg==","shasum":"b117e13e253e36df419125db495900a0ec7931d9","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.1.1.tgz","fileCount":13,"unpackedSize":29012,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbFS8SCRA9TVsSAnZWagAAVTkQAJ/UjR+TH7kx0E7psBNT\n3nma8eDC9EIEgX35eQGvoZPow47vRK/XJf0Koz4q0mUYYQqCQBpFWeaL+xlX\nq17sAcPTwsFxbur0pjMkZrU5JpQycWYK8eraWwz6MtyeF2ctly8nwu4o4NiC\nxwk7/6OQ7yfH4weeyIOw64AMp3rtnOacfh7vkQnW0ae84I/zONHUpRgnzXVh\ntlFyY5TwfdiIuB2Mtpdv+hILha3xe5Fg1P+nBQuQAvCm2BerLuOiRB/3W7Ll\nzs5trcRUd+Q2n+lUPl0e0KuSZFDYds9ioY4o4YbsxcCGVVWUT2iJxYIYCRfe\nvkCNiJXb0S+fNcxOEq+iSPbwMtZhu8MvMVF5e9FzIx8X52+b6YEDh+qfB7OU\ndn3bgo/4mBdk/T6u4AL+pUIY84F6XsS87+Mi03hQ1brqUrmvEZfRBu4md3eM\nuZjkq56XPv/j0tGK3abXTxc1fBiZIrbeefF0Yarp+MbyazNDDk/sPNhqXoKc\n0rCMoc5IO8cvS5EFlyTxxsvnMpGoDE4a9EhF+7cHOuoPUIpDLFjTxuLSXB5G\nx7qtfNPQfalGLXboVBI6JRQthu/Jg/tuCLjpVTMQbGMbeU2RnXkHh7d4J8DR\nyoqOtddqV0qzNpbm74d5/Noc33o87jUj8BTo0NQqGxUQuC81TS3PJlGYWJGF\nk/Ch\r\n=p3p2\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDITkOVGCMOL/dSZBxNAujpT3eHqmmW5Rq8Mkq0lwer9AIgagqQ2yOe667AxbQ0j6Mw6MQErfhDMtuxnUQsNq4Tvks="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.1.1_1528114962287_0.7656814716430935"},"_hasShrinkwrap":false},"1.1.2":{"name":"npm-audit-resolver","version":"1.1.2","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 request@2.0.0","rm-vulns":"npm rm -D base64url lodash request","test-exec":"node index.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n** This is experimental, built in a few hours. When using this software you are still responsible for the security of your app **\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n```\n\n### Running in CI\n\nOne if the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\n## Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"f860bca000b181ff764ffadcd0f8bb821f226eaf","_id":"npm-audit-resolver@1.1.2","_npmVersion":"6.1.0","_nodeVersion":"8.11.1","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-Nt1sNweYEyryEkNhMDCrTte6nu9mnP/pYvZw5cRS0jIaAKNqvht1MMqstttGbkLxA5qzfCvUWob45fkmt2O+tA==","shasum":"fbcfed288edab7c1da280bbb2fcfbf2124f71594","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.1.2.tgz","fileCount":13,"unpackedSize":29056,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbFjy2CRA9TVsSAnZWagAA0uEP/i99YHgWGgvUUOjaa971\ndn7dksnvJfTEbzQ8owvIjY+/iRnFpIs7BJpM4kFwg+crnSv7xeHSfhgog+Vl\nbDP15vvZotB7H8LNUnv9U6ooz8q99F3/Z6+fKIlAi3sYB2xbuUZXAxnwCoRn\nfElzXCUz+jb1Ma3Bk47l2AjhyMsiNJHcDGpDASb2mnT2t0YAAoNUAADt98Lu\nhLN61LmPFoPt0pVcCwskXT1jbdyapR8olakykg/Uru7QQv4zW5zev2qlz08i\n8HzY+/FBOZHzA768ctnTpKNx0scKoEOXafo7R0B/YiskjaMCBBrIUhHZvX0w\n2HV7tEg8A4B/+rmqTQfp5r2RvwH3IPAXZcggEiKLcGZxp/awA4c4iiEKEkfn\nECJYa4Yr6PxbxaHEBlpDHiES4be6kb8wGEmS/b1KwItG6bFYqqzW3/DrKh51\nfBuU2qW04h7F6dzcbl5m+OYATRxMnCdvVc0rbDBpJ1KUxQBwFXW0IV4jKdNz\nksFwGM4zH0oFHpUwPhwefeypoX1PgjHs4pdEz5mtNhqaJq7o+e+8ivi6TeON\ncqLx9LGB98J9ymANEios1TX8XnLwLE7oE5NLl3jPFqUNaOWX2zlkXtUVkdyI\nroiRwU106M3wivjKU0bycxkAShK/1rTuCDOBh6DX3UQSuNWIKSyEj1bSHp/b\nlgiO\r\n=X+qz\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQCeeUJqvmqMTFMyvJoI+o4VSyeRpjpa8gfeVSYUG34oxAIhAOhB57Quh+juplOmCiP5KZwAdTib4WOqYggHsIa1jI6p"}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.1.2_1528183990230_0.14619959794336346"},"_hasShrinkwrap":false},"1.1.3":{"name":"npm-audit-resolver","version":"1.1.3","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 request@2.0.0","rm-vulns":"npm rm -D base64url lodash request","test-exec":"node index.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n** This is experimental, built in a few hours. When using this software you are still responsible for the security of your app **\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n```\n\n### Running in CI\n\nOne if the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\n## Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"bfffd33ebb8c51f31aac283d537750313668e2a6","_id":"npm-audit-resolver@1.1.3","_npmVersion":"6.1.0","_nodeVersion":"8.11.1","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-UNjA3WJU9SZXXjQ91B6Wf3GjW2QwwzLMPzPyfz+9OkFs4opquhmg9mg5e/TKM6BgwTA+bZg5x+rc2oAxEqxUJw==","shasum":"1e305f00d0a605d10432eb1f80e7dcc42a6736de","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.1.3.tgz","fileCount":13,"unpackedSize":30221,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbFldPCRA9TVsSAnZWagAAI1sP/1cI3HAp3segshf0zKj5\nyriM9TLxCFSrZZhhz/L3ZQ+mNQe1RFm3lJTi1MzhkmX3v65feC8Ml/BCMoq9\ncSetqvWQaT8BehErUgXeDQveiPQxNzYPYhPeZHeqGaOalJSw0P+SS598k8uI\ncSQS9JEyZx7WWg3IP9C+ccynZSHi+O7wMncL1q54dsLw9hCTdpujRTMBxukV\nUCM4EnKCLm5rd6ZRwmW2J47AIHzlTGLY9405fRt4CkPRoCviwDoCeU7kHf13\nTBjG8BFcB5ioq7nfXUTFlo3RsKC0Fx4ag8/j89KI3un7gWb7eW/LElntUJ9r\nIovxwFP5ZYCZtx0KdWy8DldZhxPoF1cjCbYxTKEi8STaTGEgAM2qkCNYgPdA\njZ1RF3V5rx3/SZZhr6GGJ/R8xiTJGBL92ME64fWJ2+/hCU4KDKydkhctfrIF\nhFfqFVRepUbYVMwVMJ0kXjnPc7iRp99BWYHq6ROXkOdEw0d2XBd/9rO1AU+Q\nEb83eQIFCLEHLkcM95FPzy6O8Y1BA6A8Q7LYTxgH3g9CtQldiUY9K3qfTNZO\nbHbVGNCnRBMlA33cLAVAcxfpDLAxoHTvzSl5LRGxUnXW2SnhuDZLgxtKNxgV\n8dh7zWvgYSvWFCled0TO1QAfT/YIFRNp9eQjtNPyagn6CLqOkDE8ahb5LkbO\nPHpg\r\n=Mxir\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDCmAVe+NaY6VUrtRG7yL+50NlHNfyIyuYjCZ1b8mC6CwIgX8McZtINlox8UOcyVYr+s0NewuJzVt2S7ll3v+BAIXA="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.1.3_1528190799445_0.5733326411794479"},"_hasShrinkwrap":false},"1.1.4":{"name":"npm-audit-resolver","version":"1.1.4","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 request@2.0.0","rm-vulns":"npm rm -D base64url lodash request","test-exec":"node index.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n** This is experimental, built in a few hours. When using this software you are still responsible for the security of your app **\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n```\n\n### Running in CI\n\nOne if the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\n## Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"e70e71794040080225b4077733a136aadf44c399","_id":"npm-audit-resolver@1.1.4","_npmVersion":"6.1.0","_nodeVersion":"8.11.1","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-6onkwwrnQ/QaaDo5diblqc1Jc0qM63s/8idA7shG8qNxra4q84ztPyhZb0WCU+wobWhwz9IyJVnB9n2v+ZkFrw==","shasum":"e5bb6da79ead1a017163dce71ae62ccbc8509e83","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.1.4.tgz","fileCount":13,"unpackedSize":30223,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbFo81CRA9TVsSAnZWagAAGtwP/RULO7xw/32DB2bjQ/oe\nDeoTcCXDcQ3eNPe7J5My2I3wELu0Ih6Mz8bU4lAcseTpGYs4JyaVWRScP+V0\nZT4fKMTlwVYHt+dIMpGkvD+v2iriWt7wEv/WmHVubpSrACX7Va6Zxe0CvALr\nt3dG5OkV1xxHvhyTcodqOSnlplVufnDI3I6IA6AIKh32Q2FjTWV+inj3mbYA\nJvL/6R5gJF1n6ZNgKJaxZbq8UNfx9IZ9ETL1YdkkUUQr38ZV3IOhCz4ZAgpS\n36Lkf+SIq9VX0/q4qqDBRd2l4J5U0vysXJZgIHbIE6CBsTJINHmi4zwwPj8t\nb+JgvkIj+HeFTIj7NQFsUjA7KGk6Wm67AYT8Z14Jksn5WrUEJoDiJmBALYS7\nijzbuEFwHlsUfrPGBdC6BdycVBvJw+4/ljr8Tj8cykTnjLoG7wFRUZk3v1uf\nxWV7MOyyitlFDxLsvdCE5TBuMa17e4kSyGzXJuuqgw4U6ZIw05bRQLjU0TqO\nns3QyqiPZ0L9Zl/I7t7+e7CGiX8TlQVKtIwnHj6nz5Bo3bdtX964SJDfUki4\nQZhQvpQrt8tIETJjMNl7nD9tW5o7Jqh9ucTWFrC7Yo2hW0BT7Ws8pazWiX2L\nYtMTGE6JQ7CtZDh/XvhCSD6i9yXlaKKYqLKyJlb+g44f36qEAL0MuXc0nzP+\nYACn\r\n=7kkv\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIBUoP3/AsgWuzY9itEUiakON+IGQqafDlFNJd7bvPRpLAiAPLLQAQQm9lcH/P0QiIg3QAJNoDQw7/ji1sQczaR+V+w=="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.1.4_1528205107946_0.10568816682070059"},"_hasShrinkwrap":false},"1.1.5":{"name":"npm-audit-resolver","version":"1.1.5","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 request@2.0.0","rm-vulns":"npm rm -D base64url lodash request","test-exec":"node index.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"gitHead":"a1874eac9b212abbb45402c3335e62278fbc9737","_id":"npm-audit-resolver@1.1.5","_npmVersion":"6.1.0","_nodeVersion":"8.11.1","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-GlRUNYe+SpjcFs4g5D2CveeVv+0XWNCcBeL2Ccug71GtnQizEFB2BS7+RjJerCf205JMksccM2vW0mLsMcg0xQ==","shasum":"904f05d510b25d0038a1f6052de3c936679dda3c","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.1.5.tgz","fileCount":13,"unpackedSize":30537,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbFpeVCRA9TVsSAnZWagAAvsoP/je84iTW5dWsAlNm42rE\nj+tEMdOvEWxV09SaNRL6pqoi3GcUjnFN+TTryaq3cqLai9KCsvMfHYyWREnQ\ngIQV7Sp7Trg2+v/2QTpPN0IARRDPfUjbUKMF9gZHJY+E+kDr+nOUDkLsCoRZ\nHq9dOnlQp5/XjNJTLyEsblJod+HA1DbdU0engYi2xSRlZhMsu2p9pPRBUr/W\njdNFL7ZzWbib2ekka7/WC7E69eSG/XMl/CmR3gIDA5UX2LMHW2SLRVf0AHbW\n0oD5V7jU9mzmU389mkKXNLhDc2CIYpQ44oz0vY/CjC8+H8If+aB7Nv237Gne\nUfS2Rrn2F+Fz2wZjT+TrKm5w+TW8xfGYJGwrrM/3iui68/QCg8XzVYpkUrXR\nGIFuTdjwPhe1Fh5jbzJG3ux5WHThUh+1dSBA7XdZM6sVecdY8FsbdU5QmLTv\nUF5gtyDooeiTL8sBoON3yDsM//DrT42G69sXXkLTwdYdmWoYuUnq2bYjMUcL\n+twi3spYy13C/BHe40Yy8FcKZ/IiC6sFDOm+IlKLu/nIfiF2SXWa6OfqhA27\njmWSlum4D5f4I1Ztge3PcANWvXKHCy6U7hJZTFP3uggj43AxvP7188roV+io\nGo7hVVxQ+nUg/IHZ4lW3NYM1UBbA1gETor8Ai3XaakuFn8GYyIA6Ij1+n82p\nUMRD\r\n=WYfF\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIFzxShz/FObCklRb8IkUvTMxqlaJZQ+J7vGAiw23h2yoAiBq39DwrDNTRA9JcAszzfGZ1hK31/y8AScsWa02MvWV7Q=="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.1.5_1528207253248_0.32551160931264267"},"_hasShrinkwrap":false},"1.1.7":{"name":"npm-audit-resolver","version":"1.1.7","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"index.js","check-audit":"check.js"},"scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 request@2.0.0","rm-vulns":"npm rm -D base64url lodash request","test-exec":"node index.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"gitHead":"c1fa69d6e41c5e07b8ef4bff4dea05fbda8b48de","_id":"npm-audit-resolver@1.1.7","_npmVersion":"6.1.0","_nodeVersion":"10.0.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-7FjRjhERhBYCceHoABQ2LLalSYbzh8mgqzQpR5CXooTJHfZnN2mfnp6LVu37lCIWk5hvu18nE4RkeByCuE6/3g==","shasum":"446478060fa184a8928fb685d12a48c74a8bf766","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.1.7.tgz","fileCount":13,"unpackedSize":31708,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbFuP3CRA9TVsSAnZWagAAItoQAJzutfiPs7YgKc5Cg3Mq\nJzuO6rJPVGmsNxejWvjxzlO+YOPxwx9+FjiMDYMR3o3w+M90Mv8g0Zof8fSx\nvl0vuhE/cDveYqF9o84PvKeTYIOhanfci5YRPsGo2+j2oYVjZkbTSllQmT2q\nf66DW/HX6KThbxpNPFmpLWDDOjQN3Ho98N5LCgbZhuQwq9m724V/mcnl/uA7\nZRpzNDGKmOQQ4pP7yTyKwQBbKYvgK5G6uHPffnyg4PI7K1CjcunmTQyf/vvh\nsCkqcHsOJ3+bW3F+c+Y7hBc2J/yHFynfBA1Oijz+hdd5B8G0RkEfc16IePUk\nqeA9Q7ZIOQa5DrhVYTqU6IVka2R702q+b+B8ganyHxWUf+4oAG/YK+hKvUCZ\nlkpnXulBNGMqQ+ATDxPgbZbotChevVc7C0KdPPjHP4OW1D9tojD/A8WoNOot\nlkCTMt6BPXtgIMqi/1tkpLoYqC+DB353uou3A4KbxvnakjzrX98Wt7ELRKq8\nK9GCRgoIvaxtn7FlX/H4ecV/VDMyNp41u8DpIwZd/vfkg3IRs26LHwKb32YC\n0+1xtHevrIxzdcfqWzcgjD3DMXKRjjmiLzMyErOXFySM4F37nG+hs+I7v/uu\nIk7X0zIQYbdxd/BFXqNWk/geiVRgVURZHaRc9Pg7NtkH0jA0Nx6t1idNV4tW\nNxud\r\n=Ah0U\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQCMyb3Nv/JvKVz/yyyazB48tmOnYKIWnyDbu0mlQeTdYAIgDkZpgZBSX1jpQe7Khn7PnSCDpk48KDr+J2GkCX0lhpM="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.1.7_1528226806578_0.19991446461596785"},"_hasShrinkwrap":false},"1.2.0":{"name":"npm-audit-resolver","version":"1.2.0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 request@2.0.0","rm-vulns":"npm rm -D base64url lodash request","test-exec":"node resolve.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","flatten":"^1.0.2","promptly":"^3.0.3","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"gitHead":"af8afc22d05f3ec3ce184a35fed9f6dc4d21df0e","_id":"npm-audit-resolver@1.2.0","_npmVersion":"6.1.0","_nodeVersion":"8.5.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-o4KZUrHRiIqbI8HbBiaGJUwKFExwkotElQ6U5lQySzrbA6B7SdGDDa7Cd/ASSu3WRMmFvzEsFzh3SsK49VunxA==","shasum":"49b6b44abc55fe32ea4a5dc18d1904d33bc1a1da","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.2.0.tgz","fileCount":14,"unpackedSize":32145,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbJOZMCRA9TVsSAnZWagAAaQEP/1FOMAcE4YMEVuWm/MCt\nJFZVuBzj1hDY2dXavY27m0OrsdmLa/p8sfpzFwFfmHjuOauSlrAHmFFWT6Qy\nTTAsAz5obrZIKxx3VIJjRKqgyPyZ9XC8mpou8dmeNrCDNZq00CTGtstjw5jv\noZx/yO/ldmZG5fr+vxUTAblbVwOFsJigaTAFxjmXZvif/tmcjoDlP+TGaikL\nKlpJ34FdzsM+DctO6oQNo+S8lCv7B+rKoYGQQ8emfOM66dfMwH7DwaPNFYZV\nJzVYcnyj443SM9YsG6pR5wKG4BmGo7/g9qhcMZ+a3MU7vn2HtpSDCATa8m0Z\nVINJUwZ/FmXxskdcQ8dmhlWdQhSW8kWepDzq24HscLtx0F55IWM1FWn5MxGD\n8hY6gAtW+7pB1BbDJ3FxWnbJ14gL5zwGH1cNSoTEjkXwZ800kVyxo9FhBzMW\ngbFF98cK4qBf+KwzpDB0CwCgEazrTZ6QCGyVYWYIJbInoTjXa4zjS5bMDZvW\n+eg3ZasFIpPkrbsD3cxwb2qiR1RkYpvi2W8Hmo7CLAJLxJqPtPx6CafCatcY\nXTXs83pg3G81jbDWvLTDEpQZ4H+RMQxhEoMikv0yYnLFEkeSFOGlTwZFeoeF\nRBq4OXZgYUTO41JmMZrGTifrQZX080pKwUH2ZJ/SVMnoXdcTxrJAQUyyUE5x\nf6ne\r\n=Vdx+\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIBvDiP4YPgmR7rjSt0b+8dAzso9VeFf4ZuONvPR/E09cAiEA5sHjvctZ06NBWaPA7fljB//aC+FMRGEi8vng9FzdTU0="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.2.0_1529144907609_0.9385767401968625"},"_hasShrinkwrap":false},"1.3.1":{"name":"npm-audit-resolver","version":"1.3.1","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 request@2.0.0","rm-vulns":"npm rm -D base64url lodash request","test-exec":"node resolve.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","read":"^1.0.7","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"gitHead":"48fb2ca58b3f0ec683865a610f9203a3c8696ed4","_id":"npm-audit-resolver@1.3.1","_npmVersion":"6.1.0","_nodeVersion":"8.5.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-EvBZ5SFXsckdwbSc8TsijR0jHHTxeTFkvudufHnKjrWn7GZKlCtKYVx2zLHUI2GG1y/hl5Iaog1PA1Mas7ehEA==","shasum":"1bc8e2a1708de247efb595e15beee80682de6a28","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.3.1.tgz","fileCount":15,"unpackedSize":33759,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbKttXCRA9TVsSAnZWagAAQNkP/1x6wcbdtT40QSFfAZhZ\nMUFsqfQjRA9xX1BbofTdO7F0xIu/hYfUNye4tWclvd6xGgLedz6REBFouG3+\n5frMLqXG6HRXAuPMNwpkCuUGzzinBJQQmA6UJ5SKmtl1vWhIcRas3mi8FIL7\n/pRQxrxND4SwdRzOkiDjX4c9ntLpUAY9+LdmSs5QXqM+PemijfQug2y28cI2\n7mcXi0wEFprUbLDt2zq8pPLUtM1VTi77LoLJQDNWQX2oAp10a1nvfP2b1Vz8\nZws6/vXkSvoIy+AXR4MDREF1gTAmIsGuzPX5aBK421ecDunkqhNSSVVtASG+\n4vDOinsSNJamDofu7GomhBb/MrRcSCb6Y9jBsYlqAlgt547JKAPy6jJdqiBq\n6NPsbGIrI+5fRpZGFEllrPOQDgEQrFTvJUAhm8eKj0caYQxi9O6UUm0fay+j\nknVao0I3MgRgh9Iw0JuPvPRPdl+i3mxuAOhc1qGAbyUKg4dgxrUKWDn0NfWV\nNjGYSnEB6jUukcA1T7Pp9NVvS2/7G21qdLErGpo4DVeQ8Fx3YusQ8XOlTHko\nNunZr8vV/8IT1Sg2ieyuaqCdC2ulnGTDAJtyTVac48I+FQVtyCrTxgfWZ/vQ\nhF7iFjR47eCGEPMlvFsPxBbKfOPsC4xB1ZlWyB3r6m4ApJUP/Qvc51bCf5q2\nPhjt\r\n=vKXT\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQDFRhBdGEVoGHA92iwv5AVqsf9LuT4nyyzMBQH6rffybAIhALEgBkPYIuwc0B9ndzbC/gLMOQwreuutktun3CjDKY0+"}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.3.1_1529535318666_0.47250041881805194"},"_hasShrinkwrap":false},"1.3.2":{"name":"npm-audit-resolver","version":"1.3.2","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 request@2.0.0","rm-vulns":"npm rm -D base64url lodash request","test-exec":"node resolve.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","read":"^1.0.7","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"gitHead":"3079d826ad03fb00f023ea76f5f13170cd255fe5","_id":"npm-audit-resolver@1.3.2","_npmVersion":"6.1.0","_nodeVersion":"8.5.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-qaaHewHdK4XAVwQRvWNszC8p1o5UTttmZCRTf2trJ8gmAqxwqqBNGyfVmEY8mR+9siqEmD3RzasPbD2cHUk3aQ==","shasum":"6e295d19d5cbedb283335a23c42530d1e211231a","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.3.2.tgz","fileCount":15,"unpackedSize":34141,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbaJ9sCRA9TVsSAnZWagAARpcP/iWOChuUjEbSF/jIKKxI\nYnE6l1eiJ/Q+j8h1YwCAkAUKIRSRQpsp3Osyki4RI6XNxYSHJkEzq4jM39CK\nS8w6MSgGdXDaPS7EXUetu+UZO0TtXD8KGzmURmW4qWAaN6nARpS+YVmEGEPx\nks5afG3xpcLJTrLYMEbeahWpKBBS7SLQpylW7uhSmBIOnSUl3sznRRw7Xt4I\n5/WiFx5D5PE+nn3/ZrXSQ9OhZdpR2wDbrEqKW18ezWhxbKzKi7ONRxkHDwps\nUtSmlMMWd/dYsxdx4eH5WECJRzJgSCic9rQqr1XWybeAs9XwEeivMX7HVNTO\nuVbthxhSwERPRCQAjHQ3zJDtMNVLayAyZITViKd/LY9HMeNWynLGTLK4K9A1\ncIJDwSGg+bwOcsP9PsZAnli57VYgKF13gTDVPjhsp7KvgBqtBAkaKeeDctQv\nCbW/ulmbtwkXDX7xCtIAmuHGXuYeacW/v82Dc1KVfDLszZuTtMheNCaI2KwW\nzo3XHGLN2w5+oQs3OQxcu4vuD3lF8X24+R4QeCO6keCPubFatQShTuPxTgfG\n5k9dyv7xIhFZGiwsyUIf5Qp6uHt8L5MwNbdJvZ3koxmGKmNbvoqxssuSEzuT\nd9bIg6wRM/vi2QKN1a8IxFVyYYum4pjwej2E7Hp5m6zsF6kkGMXFIrRK8j7i\nujYl\r\n=sOZR\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQCTErcM33y4cWMNijOTExszg+E8K05HPGYH0+3HrtolywIgUvg0VvaMQfKPCkY+uHjF//MT0oH1SALOEcXKnSeVZUM="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.3.2_1533583212330_0.33070302994801426"},"_hasShrinkwrap":false},"1.3.3":{"name":"npm-audit-resolver","version":"1.3.3","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 request@2.0.0","rm-vulns":"npm rm -D base64url lodash request","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","read":"^1.0.7","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"gitHead":"3f32954ff83eca1c5d10ff6e5d4488f96003b88f","_id":"npm-audit-resolver@1.3.3","_npmVersion":"6.4.1","_nodeVersion":"10.10.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-dmLmWQq6DQzpce7UwbhLwB4RRNbbjW19kWowfcA2I3eb/LgpnZopmnEi4pBwHNR1CI8cyfwEyKJq5y3uTEo5OA==","shasum":"4ef946055bfad9742a3665dba4af10dc667ab942","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.3.3.tgz","fileCount":15,"unpackedSize":34077,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbsx2NCRA9TVsSAnZWagAA7HIP/3QcUSOPjryRD/0uGZeQ\nj+4aqCMPhKt0nfbJyR56nN90HAAwizzdHxJKcm5RBtG4bw6dWlMEZTSDN/kJ\nOid5hmEkqvBbKMKNVRW8Zf8jQoETTFMAAia1Noh9/ozsfrrmNE4kncE0zEpj\nsQXQLkgficRIidds4mn9F7+oYViGdFr550GfJJPfJ6tOomUPxOlh+CprNvCm\n5oWdSu86AATvJGPKHOKb1hi2vRrIvQWRnM4RemXNH8NKoxwmAkVL9gFLsnfW\nPBV/+VEUiExpPULIMIEcm+/X93dm13JgwGIHstMCSBRifWuHtdvdMxaRfd9a\nvA9xZnMUZy9DfLFLCGJflRMoESCQgoCon3RXaCGvGcoxMil6RgeYwu+2zPSY\ndDY5zYO07nk8xktpAH4pCMlE9fGMeOIjLbBgqJCfaRBIqsoOFJBvAWpmM+OE\nuPO/4a00b6jLypDg14ObQsoObHeKbcgnxHb272HwdGGb9x6Z4WXbKMFqxHJ6\nl078DPo+GwxtxDlgPdBHyWNxBBIurkaiCGKjEyIfLkW6xAcNLwSCKj/5OCGy\nwp5Mwma0JEvG4a9cBMSmCiZlPwuyvPMnoGPI3yzx/b8/yVSQuLQWYauXVgc7\niKcy4LZG/FrxiTGs77N/wvWB0go8SZsARLYkggkwVasJLtwwSH9BGi4HOs7c\nVnzY\r\n=9gxn\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIBq7In9Oq+PJK+bftixEy53SyDS6eMg+JAk5DazMynQBAiEAunRnKYXL1jiDzrTl2hJYFRPF2qqMM9oijJ+Pwfkww20="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.3.3_1538465164551_0.6411837342653699"},"_hasShrinkwrap":false},"1.4.0":{"name":"npm-audit-resolver","version":"1.4.0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","read":"^1.0.7","semver":"^5.5.0","spawn-shell":"^2.0.1","yargs-parser":"^10.0.0"},"devDependencies":{},"gitHead":"d23540239f1dfd261956e29036c1fa24151a0395","_id":"npm-audit-resolver@1.4.0","_npmVersion":"6.4.1","_nodeVersion":"10.10.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-rEbz1sMnhVtWuqAcikoSPxhQossXJwU9bnackoA7hKNv7cHHw+uqTxDxB4isrCnSHihsWQyVDNGgsEaaYumDuw==","shasum":"7d71d7ba19921e40c2c9a7b0dcaa7314ec004652","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.4.0.tgz","fileCount":15,"unpackedSize":34360,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJb7nOeCRA9TVsSAnZWagAA6kwP/iBy+9B6+rZM0VtETrIT\n2J7mYOlCgQIPcNc4WL8ou8eQY1SB8zD00iozKmX85tBdIK1FgV2hTzfkUCei\nzf3ZlshEYlU9F/7Ev5pTE810Ws9EysSJLIQWAc4OESe4O5X934WW7VN4IOD+\nD6Rz826BqJoJ9sLfHxb442SK6hqRGOC65yNWZx1UTP9PropYo9SgO2ffZDrV\n7nUoAqrS//nTL+xXkA9Y5+KSwYUpNV1zEDH1k3mQENNqBh150VnjDvUESxEJ\ndH96oy7hE2g/a5h/LbrzSBRa8vR1m3LzuSV5ESuXR7FcrIwh2DKR3V2ksJOE\nhpdOeyA22zmfdRsMeUsWx3s1h6jkY9u0+lm8Qwn03vyWVuLDrg1gwnkwHc45\njGQj6VXwNw5LgxiCk14bmludRNfB0x0hMBifL03rI76btJbE2FzE6quwtKBZ\nuDekLsUbPfnM2WrZr5seb9fX/CusHQ3qk5SREOm/NJ38JwPGRE0TUrhwvQgX\n0qde2YH93E6gM5dKpojCysE4UhvFzRlhFQuczPCxVsSfdrr7+QEjYqJAWiS4\nbPud4ofiw5sFQNQfa57a4VkeA6axHoRl43qctOvxXWKK42qzoV9S2AIjSl2D\nqHBZx7vzoAAhkCfQulN6y2QcF4EBKAQGipbrDePa/1EjjWkNm0/cF28xOwju\nZyby\r\n=TM7U\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIBKsn5zKtpSP3ga991/jy7Dc0Hsv5nmBHk74NufBeDYGAiBUzpX2fBMCNYcixxNKrBI3anpPw3AqwcIoS1wDNkvleQ=="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.4.0_1542353821823_0.8673999288119099"},"_hasShrinkwrap":false},"1.4.1":{"name":"npm-audit-resolver","version":"1.4.1","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","read":"^1.0.7","semver":"^5.5.0","spawn-shell":"^2.1.0","yargs-parser":"^10.0.0"},"devDependencies":{},"gitHead":"6a64ea805b6078ab1c0db01f6077dbf5a4fdbcbe","_id":"npm-audit-resolver@1.4.1","_nodeVersion":"10.10.0","_npmVersion":"6.8.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-b83Ru4Sy1SCtdwdhTE9dj3QBR/1f1JJfrqLhxuPOoZ7p3uEiV7qbDB6gcTCNVHEhPQyXUhkRK3wxWKZouD5bLg==","shasum":"6c61c702f54a603a6e24ad2f9a969bb76ed9e1ca","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.4.1.tgz","fileCount":16,"unpackedSize":35963,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJcdcz9CRA9TVsSAnZWagAAWKMP/1/dmLZ2b6KBFWCEBSeQ\nPcDZ6vbFNg1umVrgc5IdXPF4ERgM5CMgm3voi8DRL6AlRIH1OhEGbQTd8kBU\n8LV2R6E6li+fTmfZd2ndTn84zyJUZ70B+/yOKZYZrmWrrqc71gDdWgCGiC5O\nmQULYuzO/AYSPpsf6A1bu7Msz893pNvTAgb8vp6HjtLOK2Lbhj9CRfX91ptd\nfQ01FIk3i0flkCdSKdhYuC2b0xUxMFjFcVckPTBerhi7ZSVjSnU09Wh1wjJE\nwVgLVr9rYdQ91IWi6EQ2c0w9kkT5QCmhDmZc+e2HxWGxRTR7bz1bLCN3tKTg\nLLwGi0A8hfbc7cBCUrhNIR5bnv2cNgwS8Qyshu+M+dji2mqVh4xLBK3QLtk5\nI5ji9A0VkeSfyEUgV9WPgONWgoU+pljBk/SlvD2ef9Kp218l3B3RRNrtJElv\nSJPMz/hbdeKyV4h9lEF72bJkuclV6ZLtGdN+mnkE9VIbL4fJdJoynzcQa/PV\nbstywhDSLietvR96csM+kAmMS7IROf1vY32aI9LWzGAfdaRWOBoMkH8e/WU6\n+oBgLn8Fg0uiLvGB9uWFuC4L93H5aeVuJ/Fk9tHgJzoOfP5GpUfC3gfqxnhz\nJpkNDwW3vM5nUPzDUlqV9CZoFVAVF87JEkPDwOwlbAANMTcJOcgA9fmhBDg4\n1j5Z\r\n=JJcr\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIH9RVR/n0wqAirEuxZggoaPqFxjRQhbu+oSV3ul2Mzz2AiEAy54SfGgZaPH280T1hFXYL2T2DLayqFi5kVVTlzlzmXQ="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.4.1_1551224060472_0.7705639052704947"},"_hasShrinkwrap":false},"1.5.0":{"name":"npm-audit-resolver","version":"1.5.0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","test":"npm run add-vulns && npm run test-exec && npm run rm-vulns"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"chalk":"^2.4.1","concat-stream":"^1.6.2","read":"^1.0.7","semver":"^5.5.0","spawn-shell":"^2.1.0","yargs-parser":"^10.0.0"},"devDependencies":{},"gitHead":"e90b98db3ba60255c9f288d8b3504431078ae9c3","_id":"npm-audit-resolver@1.5.0","_nodeVersion":"10.10.0","_npmVersion":"6.9.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-pOatk9mNIVqljbjlW8MqpeBWzF9TP9x7RMIyG+Z8i1RW0180w2h/+fhYruDzzLMLwe/FlLlk6uKSygUBVzjHFA==","shasum":"d2529a55ce915de38c9163ab0f29859b07585338","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-1.5.0.tgz","fileCount":15,"unpackedSize":36157,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJckLYBCRA9TVsSAnZWagAAiPAQAJVUrfWno2o7I9S4JaTl\nJWDGSflbt8NladxgrB2XgTguDabweNLzAHjbGKIy07BDNmyaAiFlA19GOSoA\nUNQfU3zT3w7+2+bgK5oWtrearqtJmNMFtiQ++9d2R28Sg7Pg5uH4y1EiCkSO\n0lwv0wZvjs0TpO0CYWNNlyHhMuZM0ncp59WRZ6mqBjCcJgOCTNjMeAUbYx2g\nAjwqIGH07+DUrqk0I8ky/qqvG3J1JP0QAXh4NDu738AdcW8ZUzTpDj4fNVAd\nhKwa/Y0nlPylmh9kRnzcdtHRhdZseXawE2OWm5e9ZkpSJ3lFaCWBLgd2MagE\n+mYCutfT5COqlAUlaY288FevXwXFGdUXbgwO+enX47DOl6EloUrVxGbbypyb\nbmXPRLHBD+8xtBxWOaMnf/D9943aN3nAfHnDo1qKe+H0LoCTUvVgIxqo2zh4\n0SU/GyltJ7F0vTDSpe8MRaaokJMR/JbDklk6WDrD5Sy7R6638dQmKecqYsuh\nn2PIyCcWfVxCZw77qKdCshI9hctBtuXSxOzZtUAx0dmKIPFGeI36VXsuxm7C\n8FlP0iFhgKmfw7rsXJ02tYFLnJaDIJEpkexnHEP4/fCTelqbmKOh8NvgOVif\nG/wICbSKiiQfE3yjyf6Q3JVQG6L6jl6dTYdGbNvkdTeEguwNDfralJzPBPfI\nd9GZ\r\n=G/3g\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQClMRzZ8efQiESj7fpVo7UK2WRps0TZKPi1pgdTIHvZFQIgRh9MYD9yjGiRfY9HLd2nYjETUJ0cbkOUY6B8H2kPCn4="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_1.5.0_1552987648683_0.2108887768292571"},"_hasShrinkwrap":false},"2.0.0-0":{"name":"npm-audit-resolver","version":"2.0.0-0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","test":"sh test/e2e/long.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"~1.1.0","chalk":"^2.4.1","concat-stream":"^1.6.2","djv":"^2.1.2","read":"^1.0.7","semver":"^5.5.0","spawn-shell":"^2.1.0","yargs-parser":"^10.0.0"},"devDependencies":{},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n```\n\n### Running in CI\n\nOne of the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\n## Features\n\nWant to give it a go? Download this repo and run `npm test`\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- investigate - If npm audit doesn't suggest a fix, resolver will help you find where the fix could be introduced.\n- show details - Prints more information about the issues form the audit and asks what to do again\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolv.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"fc090ca41549f547058787d008d0f8e572584787","_id":"npm-audit-resolver@2.0.0-0","_nodeVersion":"12.6.0","_npmVersion":"6.8.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-Jnr3XiQzjFWtvU72KkoYmx9ZRJ5uI8/sVvIx/R2GRj8JmZDAvjIgCNMCM1mipfN3dLpsrWO/g18sOocYhNqyaw==","shasum":"b2620e1b710b347c5be2c7ff681373ce676da5c8","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.0.0-0.tgz","fileCount":18,"unpackedSize":113168,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdRKTzCRA9TVsSAnZWagAAwCYQAJ6KOMg1jevEFS/VcHPE\nCcodpLzizEFiP3i4Ux3S/d9a4GNIeXYxHF6AEbxx6VR44IZE4ie0YKMcdxEE\nVhhELCHLJbXp2S1C/HJWKZ9dxY1pG8zM/T4Buc1rIuwKV+U62Cie+y9aX0dj\nZgJ4hXb608f7xM44cxC/M7dZ1I46Xtj/j+BRpr08uTJXM/3gnpKj+aBunZzn\nqluCPqONAnB0cWOKPU6WsEAxSjaZeJFl1PSt2jTgJOAnXS2F6rOh+qDxrLKQ\nvSu3Zc741EFNdL7D7MOqXWh6Rv1iT/cLEYupnUpFCbbPYDSPTRbJsP9nO0I6\nwL4ed7fWpt6EjTj9cw3M/+28hdSu+rq6OLULdZyjaIB7mYA7DtjjEtKtXlcz\nh4KhudCFbj7ZRb3RNWOFR89V3UfaAx0Xc8MUg7pE+V421eWPH0j+qu4o9Wll\nOdS7qnfML6udInboevrydOdQFpuWHd/mlTu63eDm7p6Nve5gzKRVDxQZy1o6\nsONj8+V7CkmoDJpUpPdTu9hDs/0+37LlPe6idow9qN1s/sKP2/I3x9TVvzXE\nmjqgZmh5HA5xEaDRY4GqDV0PkpuRLXFAeo45+C6nBUZO8BmGKD0sk96SsMhO\nb0hQouRtp7ROCv4i3DSjSqQEtApahhc8Px9gO6UgeNi872aRMp3mjdAt+jfd\nMZi0\r\n=U/hw\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQCPxCqif8pEusuLcBjJ7DzclKJsRLBQ6qre2COBSdScvQIgZmgGB7KatwwNtxTqInwhtoxgSZ0Rxxfb2MRJPv6IGgg="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.0.0-0_1564779762526_0.5301188028703656"},"_hasShrinkwrap":false},"2.0.0-1":{"name":"npm-audit-resolver","version":"2.0.0-1","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","test":"sh test/e2e/long.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.1","chalk":"^2.4.2","djv":"^2.1.2","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^13.1.1"},"devDependencies":{},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolv.json` file in your app and interactively helps you manage security of your dependencies.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)\n\n## Install\n\nRequires npm v6.1.0 installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolv.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n```\n\n### Running in CI\n\nOne of the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolv.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\n## Features\n\nWant to give it a go? Download this repo and run `npm test`\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- investigate - If npm audit doesn't suggest a fix, resolver will help you find where the fix could be introduced.\n- show details - Prints more information about the issues form the audit and asks what to do again\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolv.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"2e23aef4e9a753606c4ed266daed99da1c7c15aa","_id":"npm-audit-resolver@2.0.0-1","_nodeVersion":"12.6.0","_npmVersion":"6.8.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-SZ1SQfnjCU7RPmxwdR6n8ZwFtvC93QYvYYJmP3/hL+eLMcOGgq5lLllZ/kuFdn/k8kOEVSHys+99NnyLGAK84A==","shasum":"4b302b91cffbc1d3d11b4908f8a5c4fecbe79797","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.0.0-1.tgz","fileCount":18,"unpackedSize":113113,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdRKueCRA9TVsSAnZWagAA0nYP/2grmvN/wRIdUtrZ3kLI\nXawooxv5AOkhVZFZTT7OUU6T6LydnhGSBXHxDDEI+1Fx9FC08AVcn9RUwgZW\nK1O5D9U0aNNSQ8yWcl15oFEgoBX/WAXezVyyBjLPaoIFslFoH1+XgRBe67Lg\nqnD8WTbdFSH+Gdh7/HLJcicCHebD2x/BZVjbWjZSBbM+XdAxJh2PGl93pbDv\n7KrqP1ESLKZR5WXzmSWSwUQ5bZUQIMXETpBC8hQGDBlbtCoOKTR3HY3btcOd\nrCuD/BhXN0izJNY8xGaLAFOEeNuZjaUf1bcyERe1a0hAFspSvPt7cG9NFWH4\n1LDAG1wvPA4cw+U3cwAoZPP1Mski2TeVuTLWLc+LS5ISWWPNtMHlTMFoCsS0\nAdwVBJP7uoR50zAA3GDFI1FkpflZ8WgMgrqQhzFkVppOm47xjSg+cwNvA5qX\ne4mA90j5YAu1hLIH7+Y1w3zTDsZw+XSxYvErlaUn4KN6trMV6D0a6a8HDjRY\nd6/Ez+56nvG66VwgUbcmK9ut0FzazpeReEB7OzMhll0ys7FtfyhxlOBt79qM\nFGRYM4ke754DXxj7iTJRgEdHRO+4+3gkrPFCZk7W0miPAk+7Q37DgbXS8/DJ\nvb6yJ4M8aYZ4SUriwZYkHYlU8q+zr13ez0qlQubk91C0sC6zh+LAveZKttFt\n/gou\r\n=9ViU\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIHozGY9ZfOkwVUNIRQ4HR4sxH5vrSz7e/PW34QVSke7wAiEA0U0mYWmKw5BWzycBX90XKVYNuHKJ0S7OEVzIsNOwYoI="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.0.0-1_1564781469490_0.8797178326635322"},"_hasShrinkwrap":false},"2.0.0-2":{"name":"npm-audit-resolver","version":"2.0.0-2","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.3","chalk":"^2.4.2","djv":"^2.1.2","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^13.1.1"},"devDependencies":{},"readme":"# npm audit resolver\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)\n\n## Install\n\nRequires npm v6.1.0+ installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n```\n\n### Running in CI\n\nOne of the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\n## Features\n\nWant to give it a go? Download this repo and run `npm run testdrive`\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- show details - Prints more information about the issues form the audit and asks what to do again\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"4f9c9828091ba4e0481c4bb74d4c0ce1204bc255","_id":"npm-audit-resolver@2.0.0-2","_nodeVersion":"12.6.0","_npmVersion":"6.8.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-UQp8DroyBnhTwA/FlGLvASIRy63jLji1x2jeR4FQjuNifllbd7s0IIsfmgg5M5gjSkxtkARopV7P9JKo6P3KYA==","shasum":"e45547f577a01b7ea0b8c465f12078074704bb1b","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.0.0-2.tgz","fileCount":21,"unpackedSize":114606,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdRxx9CRA9TVsSAnZWagAAfHAP/07aUKc7Cyg7XFJ+zEeH\n/RmCTgZWcQQWH8myaWlXta5Ea6aMFKC9DOH30evkdsalsUIubqhB8b7b8IKk\n8GPUkvnu/sW9Jj9v+QkzvXlNd2hAQiWmdpox1Q+lLkwJNx7Julxevz8ILvQB\nrM1Q483aRgq1aYtfMMOH8/T65uJ9SYSgBcPrD3Dav9/HF0nqarXSiakMzjV2\n5Yz7zTJiqbIwJ34hcj6x+u129AODUCSZKtHwo33bkdPkjtGJl5VW6KQLKJBP\nbstzmlgh1Cx09JyTwR43e1qjTRaDut8vmH7f3sD8Naxz/Q6prAI3TLbDBL9Z\nUpfz4QyHQsHWmVOPcaH0M5UYr66HiIPEixbUEXp5pBhIWjTHP1fS6TDnDrAA\nWGCooHpAwZYN7QSMELzsftXzCX+fTJjsz3y26zQXWtaTrcPSeN3PA+XDRsqG\nJRQIt2LlJb28dkfCnxVAmZMMJHdjeVRdYWIjbJ0gh6jq+pJ5+e+/mxS7GEMN\ntf0iDXhWArPuJntA37URrUyFjIGSBAPaVsSlf3iFwldQbER5eyVS1k639831\n6ibgcRjL9Fk2j2aGLetyZo3//AubX/xvAkqpo0Tjl2zlcTbZEBngGtskA7jz\nmU4yi0eeo5ln34BK+4l99vC92Vx7Qe3LcqFOfb7cktIr1Os/n6gFHcaHRCef\nTKS2\r\n=AdjG\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQDGNZtUD9O/mJg9an6K49nV1Zi3BqvN/c5wvgIeIRM3rQIhANL8yzTmjU8C0Gu5TcAGI2WL+rTH5N180YugQJ2NaP4J"}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.0.0-2_1564941437064_0.23470621362460853"},"_hasShrinkwrap":false},"2.0.0-3":{"name":"npm-audit-resolver","version":"2.0.0-3","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.3","chalk":"^2.4.2","djv":"^2.1.2","read":"^1.0.7","spawn-shell":"^2.1.0","synp":"^1.7.0","yargs-parser":"^13.1.1"},"devDependencies":{},"readme":"# npm audit resolver\n*Now with yarn support too*\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)\n\n## Install\n\nRequires npm v6.1.0+ installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n--yarn switched to yarn package manager as the command to support\n```\n\n### Running in CI\n\nOne of the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\n## Features\n\nWant to give it a go? Download this repo and run `npm run testdrive`\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- show details - Prints more information about the issues form the audit and asks what to do again\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"b695fa84d6ba3697bcad9caaa7aa4c53dcc3deda","_id":"npm-audit-resolver@2.0.0-3","_nodeVersion":"12.6.0","_npmVersion":"6.8.0","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-H4u630n+xpmiPhIL8qrzEl1nA6yC7r6R+F36F0rpg8kz7uCHxcgfUpdrveeRvri9Cdmvq79CIiF6W7SCmcuE2g==","shasum":"6c018f225f2525dbb360ed53c94e02231eb553cb","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.0.0-3.tgz","fileCount":21,"unpackedSize":115909,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdSIGCCRA9TVsSAnZWagAAO+YP/15BGQpchsgJ9dxPsycm\nEuvXSyqVTt433hZo6VSq1zDMf0Exnn8An5/t8lVQ16lqSrZ4UfpdOkea3EPP\n5qdyuUhj3A679pI6hGh7chIHuttPQpOtJUllKKfPnayPtVDdmAlchGRXbnYl\nWxN47NNHLI8DJXOVOS8ijMD5lTHdvIN1l3PjKoeIBhHj6C2NUUkwzkmaaCfS\nNHPeQa8Ybk++hqLHv9tuiBvggrSwu14MHO/Ua6nwzL3IyMXfboYeNyGjI4gZ\nL2+1golKCcNzFNytzXBJKyVCnVNALRX+CRxC/c8zdGppI7ThbdVnnvuMnUd+\nW8gjxEfCBSCi1lVZGexcbH9FrRBe25M4VJmDRp1zpFlb3CudHz6dDNngidZc\nfc2n9zmSkx4/ieuTWYRHzXk6uMGDh4zPpMU78T8pTkDxJjWnF2g/icEVY0w6\nxu8/4pTV710msjbGTfL1v/uj5mJrGPIaJqBxDwbiR8iTKd/9oEmGV8+56QB9\nDj/DtBW0DrsfuenaWANrKUIhJx0pNOKn40OiXkZQydMA3GxQAG+H5r9muUdV\ncXtELnoI+GvIHPXPwlA9keZzN6j3MMFoR5Z35E2TJTG/SN8prLHgyi5vaJN7\npJ5jidWXR8xaYFq957J+xQNuc8zSQ/CIUwm/VxfN2vZ3WCr8gEzq1EskvsyD\nPyiq\r\n=dhAC\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIBpQeNdhIy1Om3bBLztq20rjdKGeBrE0nndVUKJTDZYOAiEAnsNkiahzQ11w1T20mDDh2IXMY2DSa4hpy5V/Sgi8US4="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.0.0-3_1565032832607_0.40194290202674177"},"_hasShrinkwrap":false},"2.0.0-4":{"name":"npm-audit-resolver","version":"2.0.0-4","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.6","chalk":"^2.4.2","djv":"^2.1.2","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^13.1.1"},"devDependencies":{},"gitHead":"0b5d8b1ceb0fbddc9405cd83a8e93ec83acbc8b9","_id":"npm-audit-resolver@2.0.0-4","_nodeVersion":"12.10.0","_npmVersion":"6.11.3","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-IH7soIor+c3cnzycOl2WDJm890Lpi79gAORNbf5P8qSgWbKMqHt1Y5zkw4ClOXk0bBbjpy5ytEUeDS4YtopU9Q==","shasum":"047b5a80d675339f3d1e1cb5c3d2aa7d947b28d6","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.0.0-4.tgz","fileCount":23,"unpackedSize":120535,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdg06SCRA9TVsSAnZWagAAxRAP/Rx81GWbkS949A05fwMB\nHjJHFzags6cFtiDH5bkJRh/+4mGeyDiY+sXmqPQln8gmYonxwjHykeAXtMlE\nEXjV7r7pRgyXPaRsNCkvo0/fmdXzYXmBnt6JFlZbP5VGQIVZw+NdlfV+FPXB\nPqIyKUnStpTRDaeF7oFydDhbmdt2KDeJLLiC0LvkQPi404ERgEeMyiM51Sh5\nIMS/X9ODmv0aFIGqFe2H0LpVh3/cDQ8iRC+bBhcpn/dvo50BNfNjY3vPNgmw\nL2W3eKjDzLhTj7tP/KvlswTksQd/xjtZcCDencNiT/jo9pnvBodvdqkh7rlc\nn+pZacQiziqSQaRfCngSzLUznNakNvfCbmFivHJPkY0WFu6JtPaWN+nuwYg6\nEC53y0yaoVZOa3vT6/Y5pQdSfdbHmoo9gdTLFbzAkbwtcL3ZYeE9W9AOhF3K\nOSmtRy2W3Dg3MN546RwliDsG2DVMKiOqeQ8xuCxd9lzxc0u7wKFc5wb0i39f\nYY4WTP3Znhaa3uRn7c1mfM4A/Jx6MXerShnkab9yuPdPX3sLhuoovkxgAqBJ\nn4YNOD4Xdo27A2Bm/XpDtodVF5Y3VYUkH7+XvAAQ8w8mXAzuamDgj30Qtfur\nYx4NlP+owAAOmAut9O8AoESPxRZpFtll3abHMMgQbcPxoXpEIIxYmKY0nm4a\nOAn/\r\n=1C3X\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQDj/DLzsEC+CBZZS/075KRd97nXzKzZXDtrnlffCQ8FKQIhAK6XGLEynL9fUYc22UZuP+NtnbQr4XcLFf4+oAFJetJQ"}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.0.0-4_1568886417531_0.7706018619811899"},"_hasShrinkwrap":false},"2.0.0-5":{"name":"npm-audit-resolver","version":"2.0.0-5","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.6","chalk":"^2.4.2","djv":"^2.1.2","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^13.1.1"},"devDependencies":{},"gitHead":"8b8b337356790496002534d4c080e77d93aae3f8","_id":"npm-audit-resolver@2.0.0-5","_nodeVersion":"12.10.0","_npmVersion":"6.11.3","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-c3u6b4pPTl5nv7f0z+i/Wvyl+IRvPDCkC75q47GZxCn5optNCx0RBJoMN2Yiaf3tIS8XrAcTz+m0Cmvc2/m98g==","shasum":"b7f106b67b1ea96e6b31b96d76b4ed87c46ac0fb","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.0.0-5.tgz","fileCount":23,"unpackedSize":120536,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdh+BGCRA9TVsSAnZWagAAROYP/RnWnmPn4Jfv/hUdUdjW\nqyEegZiBqQ8c9LFT6CmDYZhAw6i2deHXko2/jhICitYZnCGh0uRBFU3w19L8\nmDFfFugAz/cGdTVgOpIAGRyHSWdz4iMkoCquCmEXE7r3rpKoLNVAJOtLLF34\ncyYDXgn8b/dMvUYMelP157jpVBm3fM7Tndkf1zY76KQP0x8cm5NElmW8l+kS\nI5jVvE9x0vzWZPxGzPrhA/AYYrUR4gKYopiFJP5kxyqDRz0kUSIgVM0U7JpP\n4Rcn5vCZaKo0VpxTdnDg8YAbx7PInld5E5oLUjqOMsIKfXYAKtrv7tUZPigH\n/DOdtie5jDf0D4C11yGKNAX4ZCHX55izRUWbQ8uH0SWMoQD5p5pFGihpAX6v\n/FGImGOEmg2EpZHwZkt/zTARMJPct44i9E7BQFUh5lV5llyuwbDhRD2TnXJe\ne7rUsIjrP4pYns26ifFcwRsoA/GSl3PNxtcBsA8zhgS+gko6MwpclqoSjWtB\nCnCZqsghtvhw5mx6YRFgL9XV81o0ULpSz1Act2ju5HD5AR72ZjP78m+wir+E\ned3nwcyyXiTDs4oVqOPlpWE0H3vTJrclHr8ivrKQ4EeqOJoOUpxRYHw3j5mZ\nYvJDZ68yUC8VeC2ezIqzifW4PmQVsSSTR2BnA2Ny3FDujSuw37hGXmgMzDVb\n/UVR\r\n=ZAIW\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIFqRwOxUg+fRhJsRZ0gGPfyEwCNrNApdKM6QlUx3DVB2AiAqnqtxdBY98RPFW4BOO8nVwdnsNVftDZjWI6Ra57RBtQ=="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.0.0-5_1569185861566_0.6365726740342008"},"_hasShrinkwrap":false},"2.0.0":{"name":"npm-audit-resolver","version":"2.0.0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.6","chalk":"^2.4.2","djv":"^2.1.2","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^13.1.1"},"devDependencies":{},"gitHead":"d470d7e51e91cbc957d2411b59feaf5790beb64d","_id":"npm-audit-resolver@2.0.0","_nodeVersion":"6.17.1","_npmVersion":"6.11.3","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-BHxiYlt6fWsr6MWxBw3Nasw7CplsJ+e/jXZY80gLemUnYhn8HzwSB85QoUmjCdFzAb9WP84xSCIjLbiZFqzTZw==","shasum":"5400f4529e3405d9e6f941e19aea1a01cceb106e","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.0.0.tgz","fileCount":22,"unpackedSize":119041,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdioikCRA9TVsSAnZWagAAcRkP/iYiH3Qro1Q68vCyaCSI\nuipVLjTbs7vkOk7lVPdUa2pNpBZjzEtWOBgX13uSaDceqrEAG4U5JRHbI/K1\nU6hT6VHwq0Gb50/HyXjCKqpchotEzliNHtp5OMSyw+Tobn0Fy6/wkFg4Zsn2\njNbCDjrkQnb6xtXCHqM+pOVvteGMfC+dbELBnl5h4XqnWL7dbM/bCZk3AkbM\nAMkTFBTq9fB2lGVb7IYKCZQII2A2rh/Dxxjr/G0DMexvJnqGRsxAFeZWpQ6k\nkSEs0OWu8p4q2kWR7xODJ+St1g/potXvZoMFWdTBaUJ9Z0mQp9QHSl/eQoF9\nxmL6Xcwr7gl9lnAM2NrC/8zPJxuaWmLBMrN46cpYbqvkHhYxC8oHAA+NqwKk\nk9KwIGR02Sm1+kBF0Jj83TLRgCcIDpGztZ2vb4TI+fFrnlJc2stQ5BpxG5FY\nvM2SwNvg8/9t0T98Bfyjc0pBNgdLpnwsEfgMD/kjldjroQQzLtsUZOpxGcZ5\nb1lVvR+dYhLiUajOwkcY9f3F+EwIi/LoMCIjKoMPCyLmQW2D/QKPCFMFsNAE\n9VZEP/3WVJUYz5ZXuDiF+qcJwfJqLsBabPXFKkd4rAXwBdo5Bp3MAEX0Fp8B\niWX52I9/sD5lRhC/OTVyIZAHiIAnPq2wkah9pPJaJoAlhcdMf0rhf4xdJbDj\nJbMS\r\n=BupF\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIFGYohUZyA8r64lzvlD6hBkAzrMQR6C/pGPGT2Jdu0Y3AiEA755NDwC13BioTHOTDk47pM+FPWkEMqqxMsj5vlxbtV0="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.0.0_1569360035055_0.010742561488302327"},"_hasShrinkwrap":false},"2.0.1":{"name":"npm-audit-resolver","version":"2.0.1","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.7","chalk":"^2.4.2","djv":"^2.1.2","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^13.1.1"},"devDependencies":{},"gitHead":"d14074d2265acde0d4f78d7242f4f35abae7d9bd","_id":"npm-audit-resolver@2.0.1","_nodeVersion":"12.10.0","_npmVersion":"6.10.3","dist":{"integrity":"sha512-8tV9j3A+XicxWo4vv9JczIp7mf99ezXPAKN3d1KmsIwspvAozEzaeMoF+Eo7OgubIYqhdGILnpZ7NpS8EW3C8g==","shasum":"8e30666075f8e8a344cefcb359509ac07a024417","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.0.1.tgz","fileCount":22,"unpackedSize":119041,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdjHPsCRA9TVsSAnZWagAAHwsP/3YFGbHiHXTkMIFZUyV/\nata/AfL+pstsyp8/J2/FsxeaSwLS0n7D+ebuDk00c6lu7Y32uV9rVNPi36HE\ncZpo/EmbHv5sw0MwsGrHbwwzAark36KYSsYPpOzCpWHwpLwG11Gaw1nGRJI5\nZ3UG4a8EcWoG+mK3zyf8g6yY1mulDJMJnv2PL5ToJTpum8koLp4ic4UECQeN\nX7YUqXew0JFJB6+AJlcZtoe/Hs3EIJacmgKlNzeJ3JokRxfMJsSYaR30QLrr\nr/iAtyygr7yDY8zWptgwAHG/X/443uQjutaLTfKYnG4k+is2HV5/dlsLvc4W\nb/Cnbv2wav/YNLMs5eKkW70XMAfYZ4mJoj50slkAN7DDFrhb+mh/ldrkE55U\nbz4hSMYzzDn/jnuSPZziGFyTO57Oh8ZS4m5EMqn9RZlVSOtieeHtPH9bq+ID\nGyHCj9KS4vY0yLWVjRTTIex72pJsycGVWMfbzB1OO0BTSD0DzRCQUJRYnX6t\ns2Uqp3rP5z7N+kG7P8psvgLd6d0C8lV8rWCC4LP0T0ELzWHxMiUmpYf6/Tpk\nBVk5YcYEOvVvt8usj4R+sqverVqngjeZ2wMJPnPS+WxL3+epxaO2f5krHgFZ\nS7YnRZRGWyyAzA4diZzNseycWKV16qbtlMbXM7BjTSpSsUY2XrDPuUVkP8u6\nbXTj\r\n=CGsL\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIBmJgXo/RWBAByoFoHyoYzTZjYdvI4GUUusjsW82GuccAiEAjntl1sDBn0oDZHL5P/cqsWGcZyQ1Yy9SFQp8BzcJNjE="}]},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.0.1_1569485803780_0.3610371012841045"},"_hasShrinkwrap":false},"2.1.0-0":{"name":"npm-audit-resolver","version":"2.1.0-0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.7","chalk":"^2.4.2","djv":"^2.1.2","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^13.1.1"},"devDependencies":{},"readme":"# npm audit resolver\n*Now with yarn support too*\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But sometimes you need to manage your security and make decisions about the dependencies you use.\n\nThis tool creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)\n\n## Install\n\nRequires npm v6.1.0+ installed alongside\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--ignoreLow automatically resolve issue to ignored if severity of all vulnerabilities in that dependency is low\n--yarn switched to yarn package manager as the command to support\n--migrate forces migration to a new file and format even if no modifications are made to decisions\n```\n\n### Running in CI\n\nOne of the problems this solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\n## Features\n\nWant to give it a go? Download this repo and run `npm run testdrive`\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- show details - Prints more information about the issues form the audit and asks what to do again\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n","readmeFilename":"README.md","gitHead":"b4f40bde763c1cda7c01b4ff64f27240e516b578","_id":"npm-audit-resolver@2.1.0-0","_nodeVersion":"12.10.0","_npmVersion":"6.11.3","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-o7cvi0g6rW6AAYvZiyi64WiAt/MI8J5sgm41do1M+mbgQ9VxagyoM3crXSA/xsfXvl+S3xhNPRrVWoIzu0nxXQ==","shasum":"795a8af8441c59e513fc69ebfa0cbd7c1dee7fef","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.1.0-0.tgz","fileCount":22,"unpackedSize":119243,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdkvz1CRA9TVsSAnZWagAAyQQP/Rt5w3HOzjVZxPxcGvZ5\nQ799z216fSByIvVjLLHeF88Up8jgAuFvgDKL7LPvZBhYtHv9HXT1MeSzMhu9\ngIbKt8o/ZuyDf333DW0X73sLLvth6fnQieMPZfGNBnJAJ2c8J1t5l9udi0lY\nb2djgObK8bTzT7iQ4KFGgvI7ZyGnxbg5l/tQcee73hoE9x5zk2sPemFUoRru\nmuFqox2KPZYwlGkVX3w3Kfep4MRhe1YdCOpT4gtr5SVV2z270JEJNTvm0lsv\nnN0O+evHvi/R1HNQClOXxbR4h9HbSZxrNcFWJNK80KfW/RfqDEjKTUI3yXIa\nYx2NBT1RJdVRr7wBB4RM5zK8MHE+mBfd+UvgxbMGcU9z4tJuIdK3i2T7/KZw\nBY+E2ILKUGahRMxcgc2VV/q1rXeIBdzAz82oIOSuWAim8yPW8h8D/fVOzqb5\nNYQTosf1992gH1wGELtpHnuS7tIx5hxyDvKQGGv/O4Iktw1gVqqNe3sZPWGW\nhOW8WZmp/5PmZUTXQXY0Vlis0ofZ81RiTv4TT14hV6e0j59YjuzTLeOUyHzi\nlNFgf6LLZTBG69E8tUJVt7pdG0wXNgD01TxeEucZm+gG3z4t4LglR24zrZyk\nWcLosRlKLty2ProL+DncRgj1W9SXzhb2oeox8W6l6tpQ6B9Fj9NyRVuPm7RB\nRcz8\r\n=m4BA\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIGF1RHOknv0wLlRTP7H5SfqulyGe+CqPyEd3xkm8ILLmAiAi/j85r26YV2A8q6YQ4jGKUOLoOaaJ05m+yRFrb1SS2A=="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.1.0-0_1569914100602_0.1735422547531975"},"_hasShrinkwrap":false},"2.1.0":{"name":"npm-audit-resolver","version":"2.1.0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.7","chalk":"^2.4.2","djv":"^2.1.2","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^13.1.1"},"devDependencies":{},"gitHead":"b3dff85b145be8aa5f3801cdaaeee2b20d5e751c","_id":"npm-audit-resolver@2.1.0","_nodeVersion":"12.10.0","_npmVersion":"6.10.3","dist":{"integrity":"sha512-8VaG7p3tbP0+JbpDKldQueZvh9oUcr3H/C2FIbcIhYBANAQ1kCIhUqYOxVFjG3RKEV9G1coIFzUOxBoPyyejNg==","shasum":"46d3cd9e40b72ecda5bf00173d35b7732510acbc","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.1.0.tgz","fileCount":22,"unpackedSize":119242,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJdsaD+CRA9TVsSAnZWagAAjLwP+wWnVY41TKSsRbRyDfIi\nDU9+SEoBQMSiBoMY736VtnZ8R8kgza0rAjIPmyziu/E6U80WBJlDd5ZYVLDQ\n24Qq2ihQ3NXhyZ+q3ElBsXviw8L+jeSEemfdhoH2kWHT9x3OJN2de/Mi/5/K\nmeGIAJMqrZFy1I4MeR/k6O/vmGYdZGOVcJmeKQ4L1vVCLfF85aoxu77FjCdo\nC8x6p2thGE1UZCwAwbl6ZeXVHdIJ+0wtFj4iE2Xo9MXpmIgsEb+CMV0ssshn\nHMGolvrDdIm7oe5LUeHeH1K37A/lwYsNoZ8/YZo0GUI8W4etO0xNumhzg8G4\n/hGu9YNnj/luQmbjDikqy6PgXZmRMSfUxCU0Ycq7Q1rTa/Z8gaJ3qyyWZAPd\nfYEa6GPWm/RJ+mSNW/Wod5jDObGP87jcZYtQSmv1yFDdPMpGw8ZnlR7fhvyN\nuJT1nz8tk6JC8Nwsc85/JmV9vJIqS7wrrlgds8+iGHWZf2p7xfFZK9kJgfXM\nij0jJZIow23okRrTELBQHg+AipEnySOtjLmTgb84byugXKuDhhCOHRHBLwOW\nuVX2L/ydRp9XAwNf8m1tNWNsw0F0UoMb+PnzIlpdbFLki4IlIJqgYzHjXZyl\n4hYBVKyY+4+UIwU7ZijRox8/Kt3NuJDtC67Lebeptw8MfJ+5/WzZpHM+SK4m\nLB5U\r\n=aTcJ\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIHnv1aFzq29j/wEqUTBHyGXL0LTf/eV6KcTk6jpUXYtcAiEApZUv9HVC4g53AVh44O7ycpt1A5NkLqUhpaYOqva0jSY="}]},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.1.0_1571922173828_0.5239672979943388"},"_hasShrinkwrap":false},"2.2.0":{"name":"npm-audit-resolver","version":"2.2.0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.7","chalk":"^2.4.2","djv":"^2.1.2","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^13.1.1","yargs-unparser":"^1.5.0"},"devDependencies":{"pre-commit":"^1.2.2"},"gitHead":"b2fcd49ee8f2e3ae65862b17ccc9952a2daf3cba","_id":"npm-audit-resolver@2.2.0","_nodeVersion":"12.10.0","_npmVersion":"6.13.6","_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"dist":{"integrity":"sha512-nBhxrc0Y34vIFl38G42PkWSBEbOAL3Gg6aRxm1hYzM4Vm+Rv0ozALj2LixdeytkUC2OGWP4QqCF0fKAb14NnPQ==","shasum":"4091a33a47337cddfa8377edf1750fc40c42a0a1","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.2.0.tgz","fileCount":24,"unpackedSize":120703,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJeKiwrCRA9TVsSAnZWagAAdRwP+QCZRNHJOeaw2UnpiY2c\nCMqGajkQZsQ/jGovFQrPMmHbHjcJhoV9vziXeD+2OUDxr4pT4FwqV5ByUlpZ\n602NrFq+P6kpYtI7x5wXU6pWpf6S4BFlHJdml/pynTSUYjaTwC+BFmEcM3ny\nNFoSb102diOLKYa+VuXyIWctrePLBk45+CLEAaLgC6QB7srrrVLODgUYHOl1\n43wmwkmQoUUlbDbAiHHMH3z/MvSy9Uo3ZMx7RKW6XdhSOyIjkSWxoQnVr5bx\nqCN/jTE/tvckI5RXGeE+XwGRwFrZHps+AdzwIe9ZJdY8tViF93EFgLzIHZy5\n5p9nKQSO32IcIzPsksDqWIQb0kDGdl9t9G5JpB61mUPvNKWf0R9XaYWdgzUK\n+HxJwKI9FswrjVp4CrUKk0HXJ/gJm6IVOBKkCvepa+HPmRGzVoDqA8M+cDYv\nA2ox8qBexzI51/dniEvB7C8o8G37L2bBerBrwL3B8Q8gt21NMzLb9JZ94XIp\niRr5dSKiPEBVCV7LVDGQmi8Sh1OrhLfRp7mNHXFQQccESmACD/++QjFlkLyF\nZuesamc2pskmOmPQPssbxyeuffwBMxlYnDa8HQaQ51u4ICmRsrUdP1XEkeNS\nwM+5Gx1xdE3JP3mtKla9IX5neW7EnbcVukMBFVyddriHNt83uLQa3J+NVpgd\n0Ayp\r\n=i9KA\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDngsTv98xlM8zsYwjII+qQRr0fSLdv/81h0aZaSKUwJgIgXRdroEDXmwz/F/T4VERO9z6HRjN78PoyJMNk72iQkFM="}]},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.2.0_1579822122992_0.8025151080894424"},"_hasShrinkwrap":false},"2.2.1":{"name":"npm-audit-resolver","version":"2.2.1","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.8","chalk":"^2.4.2","djv":"^2.1.2","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^1.6.3"},"devDependencies":{"pre-commit":"^1.2.2"},"gitHead":"5e0305307c803b4b70976c3a3b6de6a9afe82836","_id":"npm-audit-resolver@2.2.1","_nodeVersion":"12.18.2","_npmVersion":"6.14.5","dist":{"integrity":"sha512-9Jo5EdxREaXRrFm7eiuT1qu7fXKDfO+oiu+EgvJ/JCd2PIAgzVGF+xFoNK9AnyUsMFvSTdJM6+YlgUgF/N86GA==","shasum":"e9a42c171d26b01d7aa75b38b404b9bcc8163f9b","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.2.1.tgz","fileCount":24,"unpackedSize":120703,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJfD1ijCRA9TVsSAnZWagAAdhcQAJlCOf6qMyzJIFuhnc6b\nzrYEKd01vCPF2S/dkmfsWq1du6TrwMvt5gd0tZr1umjLJ5zObsoDeMEiLs40\n+cYcZtULVT0K/DKlxmaa8qgaltdPBR6PyAi6hZ8dWhc/FD8TXUVVkmhJhaAM\nGWQGnXat0CtIcI83MQrMdB3lubynX8+DtxAYGlzpHp4aKiPgg2yDSe0gZ51f\nUEofBa4Tg2tLBHwofLSXFO/PYpbeZGiw0N8pKhsnrAp31kHoJx/cbHhGKe0U\nwT/sG0z7AXAx6SktGw2NFX7gAWUgXeij+oXNxTA0mR6HdrAe8Oe7C3pgmNvG\n7QtM5DSwDGSBSJxgjppjmI8+swSLJB8OVn5vWfykyOaaJBpVV8rGpxY7BTta\nXWK9YQvobVNUZkAS8mCIoaYH28Kosa9S8tg1s+/g49t3d7YK74L6OpYzIVlO\nkPz6To5Ht0xxfVMNUtlLQMY8edQnuQsVwf1Xz+EVuAUwsbvbpXssXklbEQXy\n5Yx84r7jw43RYznyCPLwGOODS5gHjXzZSRym/lXj3auK+lTh2eIPmFiLHZSe\nJwmEUOdJcLyK1tYyjr4pY9wqG/YiS1Ya4lSrLxxEuYZ9BF3eyiQbaG8qgY+h\nqUeBYsNI5idRpTcM9TDPNFuA4CLl5t15I8DYVOpGh8/rKmmvV2ZkpyhsMcl8\naUGm\r\n=yREp\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIDwaBNEVz2VA1zyQ02+PIzAfT9t6NUc2hEvf/zq5Ce6aAiATfaPtRSbjs0+A68FFVubuclzDNtTQg4FnmmyYhhjNYg=="}]},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.2.1_1594841251575_0.5551026875981675"},"_hasShrinkwrap":false},"2.3.0":{"name":"npm-audit-resolver","version":"2.3.0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.8","chalk":"^2.4.2","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^1.6.4"},"devDependencies":{"pre-commit":"^1.2.2"},"gitHead":"748c195312619d2bd665b9ee64b25658f50b2097","_id":"npm-audit-resolver@2.3.0","_nodeVersion":"14.16.1","_npmVersion":"6.14.12","dist":{"integrity":"sha512-yG7Hnbo6GbmokmsVoQgrK7hVtn0SW6zhkDUldDTNaz+3/q7jWf127tBX2Sd73P/Qml1Wd7MfTuAbEXshyNZxjQ==","shasum":"49fcbe2cfbcd7629a28797ca9c42b52c3d6a3e9e","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.3.0.tgz","fileCount":24,"unpackedSize":120709,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJglZeSCRA9TVsSAnZWagAA0gcP/2EwRD4PSs3hcK+KF0YG\nvsgGztR1fR3QbkZEooZC8ZVaOAA/u7Lkn1kB6+liwXpGSuQU4a8wi5KB2M56\nQJGJ7jAAXyveM6nHjkNAUNLcnGJ+hIECekuedGC5s4JmFK+bCyIC5VA3te0z\ntkzzQumr8sL3dKbk4Tt8SxR4mgzIMGvze8DpQIxGh+TTA6Es3fhJsxOutTzi\nmVuv1gVD5kMFIWMiT7uBEi84lrPKB7pUAm/6ERgAT45Ds83G5TiSO6dz5pqY\nftegBGMGvUOZLFgmheGI8+KQuRQoHcJvfskuIBrwbR2nOBBtVFOe0rm+y866\n2eKA7usLCBlL62PkVRpKMeztI0UmT8KQ6w75Xb43xVLZ6UB15noV8s9dqVI+\nOOgEOkioA3kmKzvtd27soH12viHxQdDD0U+/aryW4xYWb1B/odDSgFZDP27V\nkK00cqIy1+4XLZnUwtaG1eZjMGusGYtE3rKGhKZCCK8ASgCdIAAlyDTXJGyr\niOtAKsuYfz5m8qDL30Xq50XhvIdjvvjjX4T9Wi/xZ+E45JdJqTy4FQiAeiB4\nuX37y0THY9IWbBCLlQi6zLKu3wwLancC9nAz65PwhaR9kPtFSjMpSKBqRH3j\nNF0ITrq2t3KbKVbX4ELvmKlghvoC2iWg2TRR2iGxp6fbUC/PZa4QHdLTpOXY\nhNBV\r\n=6+lB\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIEsing/tqXvq94qSO9yRVUT06MuNr2HrspB7eTwPNqkFAiBfaZHW0qMzT8rZ0aK7GjE1FTtlYwzQV4x0Mocp1aKMPg=="}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.3.0_1620416401452_0.38166451083483666"},"_hasShrinkwrap":false},"3.0.0-0":{"name":"npm-audit-resolver","version":"3.0.0-0","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"git+https://github.com/naugtur/audit-resolve-core.git#v3.0.0-1","chalk":"^2.4.2","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^1.6.4"},"devDependencies":{"pre-commit":"^1.2.2"},"readme":"# audit resolver\n\nA tool for building a responsible but practical supply chain security practice.\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use.\n\n> I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. \n\nAudit resolver creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.  \nYou can decide what to ignore and for how long, or track what's been fixed before.  \nThe `audit-resolve.json` file sits in the repository and you can see who decided to ignore what and when.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)  \nI'm participating in [Package Vulnerability Management & Reporting Collaboration Space](https://github.com/openjs-foundation/pkg-vuln-collab-space) where I intend to donate parts of the audit-resolver's core.\n\n## 👷 🚧\nDue to changes introduced by npm7 the option to fix an individual package is not supported, temporarily - while I work it out.  \nYou can run `npm audit fix` after marking all relevant issues as fixed.  \nI'm considering putting a fix-all in place that'd run the fix on entire node_modules and mark all fixed items when done. Feedback welcome!\n## Install\n\nRequires npm v6.1.0+ or yarn installed alongside   \nWorks with node 8+  \n*Yarn support was not heavily tested across versions*\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--yarn switches to yarn instead of npm.\n--migrate forces migration to the new audit-resolve.json file and format even if no modifications are made to decisions\n--mock used in tests\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n### Running in CI\n\nOne of the problems npm-audit-resolver solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n## Features\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n- Further in the future - because a maintainer you trust has checked and the vulnerability in their dependency tree that you pulled is not affecting the package you're using\n","readmeFilename":"README.md","gitHead":"5b6b06e02cab3534be778125570cc30fabd3b90d","_id":"npm-audit-resolver@3.0.0-0","_nodeVersion":"16.2.0","_npmVersion":"7.13.0","dist":{"integrity":"sha512-f5slSr+jZCyaP9Xyh1gCwT6a9l1/Qgb7ic3gYvL2BnVWiar9AYldMGgE8WaIDb3o/M1WTPlkfOGB1QkxwG4yGQ==","shasum":"74f43a9e846500171cd9b49f89d317a6b024eee2","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-0.tgz","fileCount":35,"unpackedSize":256789,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJgsAh7CRA9TVsSAnZWagAALCQP/A1sAf2g6U/dYAqrH6iS\nKI2ApwfnsqFUUMJo+a2Kyl6j4YqRXnn68/UoU+hfhe0YtFxMLjCcpBInulLg\n9nSeUj2yGgldTUtJve8yuoe0au6gI7En3rRD5v9yhCbjwsr3bM7YGJRAbkPl\n3UCDL1Ieh8GHGhlMFyd6gA5OaSMMBgQu3pHklaDnzAchiLmLvlT5Nmir/OeV\n4xtgqtj+qTUX2zxKQkZdG5EIcDI+z8VEjye3jBHwuvgiPAWQsFfWvz5pIDBc\nyP7wjRpFbmOxKPYaG0ZMAPFVikzKLV7b7ta6UPGRNOQPa/O529CTXrLoUyn0\nqEdP96D7DPHtEi4LHZOxw8P+96VBItMMMbRFZO9Jhzw32E25qCmjAJg8I/3k\n6RTUUZuzgj05tuErSYUmPKdFuzcrYBFp3+fxC4gU37yXGpwX5G5++fcIy0qc\nksd4qwmq5hcsSUmjBVUR9lJhfL71MXq6G/1HMnukSF2kKcCedPYQWs1hUWpT\nbhenJ6SN5NSTguNd+DIF563ffinfdnmhniu8UZjXxEI/1n0HlYaBc64vldU+\nO8AR33cqdu1d9B0B4YUkhRwLc6WnBGgibS2IwLUmpqV2OvVtgIyuM+46Ve6N\nFsQfJejjRPk6x2Z1MJDYJsrSjn9hZf34d1Mcn/OfYb0+CKU904i1Qgz7X2sN\nyjf0\r\n=e4MO\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQCvDuDDp626miSuxNk3LgQ5CEXf5v1iqclUACO3sCm5HwIhAIVvJ7xOzLtK4UJKsKRRwuYS8ivLs3Qq3gYAO0RdzeoJ"}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-0_1622149242616_0.33634435196107937"},"_hasShrinkwrap":false},"2.3.1":{"name":"npm-audit-resolver","version":"2.3.1","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^1.1.8","chalk":"^2.4.2","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^1.6.4"},"devDependencies":{"pre-commit":"^1.2.2"},"gitHead":"c1d70ef06e0336c0bebe78b51f835a68fd6cb979","_id":"npm-audit-resolver@2.3.1","_nodeVersion":"10.24.1","_npmVersion":"6.14.12","dist":{"integrity":"sha512-vJF4v4UxMKGFdbGRl2II6oJ8dCpBFfhD1oONZMAfept4RM0AyHVBEjZgDrpfEJ4EjNiO9NZLxon5Fl8bM2s6dQ==","shasum":"300156c5773a92dedac842e0732482ef8405a1c6","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-2.3.1.tgz","fileCount":24,"unpackedSize":121602,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJgtNvUCRA9TVsSAnZWagAAqR0P/AzZw9idvVmL+TcIjapY\nNROLgVCLJFH+MAeMi/Fa2D3dpB+Fw1CLiMyZQKFBp7Jc1JgiIX/D2SD2sPzX\nqsWUhqONsDliI7EomDoHzPTGTwxa740PvEFfI7g+TlYyPeqWLqBVkSIUTKJt\nXS6zqQLuewSu8mave3n+NoC8qsGeZrSPTm4joLafCccEkBM0qbCmLMokbMiM\ne7asRxTPi/xGY7jUQr7+euKxl2s5iNJXzRnlb5hpiwU0QN3V4XpbthEWBiRM\ncFLMKouvr5FsDIL9TcT/yOhO03BdKUP2GX5x2JKSMV/gCAb1ADqOGyC3l33A\nsfWM2PBpyEzuf1eOVLex4TmSb9KJKTK6QQGXD1gB1nRQJ/tJjP3VTw2BAMyW\nOhA6ghEnIpIWO/+F3voJChN+8IoJdHu7RM1Y1IoGrL8//9yednVYLQpn4lbB\nNp4kgKkP5o+sCzH4ZBNRvPf+exQC63UGa4oZ9l0obPlk3wbtaEw7rt6GCPYz\nmj/qtegdYjWJqrXbuwTbhFNuFLmIU1A587sY9Bko0i1kX1/R1Cd0l3LrZ9u4\nM/M7nRPz8mQiGv5xGXt6v9kyRw2jbWdItm2I8dkiGVbs07mjRRnQIj1FhXXj\nVcFthdFc0MNrDmfMZMtB4xUT4S6mHDTJEmZxZ47tkIOW7wgH5efEbHi17HXy\nSc6R\r\n=3Y9Q\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQCJcIsUFi60F7+697+s22vI4To3OMCAIWakolOxWDDpUwIgHSJaWTJJwbieaSb2DbZEGCqSXBsIEd9tSY9rfadjaDY="}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_2.3.1_1622465491813_0.8247460312130024"},"_hasShrinkwrap":false},"3.0.0-1":{"name":"npm-audit-resolver","version":"3.0.0-1","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^3.0.0-2","chalk":"^2.4.2","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^1.6.4"},"devDependencies":{"pre-commit":"^1.2.2"},"readme":"# audit resolver\n\nA tool for building a responsible but practical supply chain security practice.\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use.\n\n> I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. \n\nAudit resolver creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.  \nYou can decide what to ignore and for how long, or track what's been fixed before.  \nThe `audit-resolve.json` file sits in the repository and you can see who decided to ignore what and when.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)  \nI'm participating in [Package Vulnerability Management & Reporting Collaboration Space](https://github.com/openjs-foundation/pkg-vuln-collab-space) where I intend to donate parts of the audit-resolver's core.\n\n## 👷 🚧\nDue to changes introduced by npm7 the option to fix an individual package is not supported, temporarily - while I work it out.  \nYou can run `npm audit fix` after marking all relevant issues as fixed.  \nI'm considering putting a fix-all in place that'd run the fix on entire node_modules and mark all fixed items when done. Feedback welcome!\n## Install\n\nRequires npm v6.1.0+ or yarn installed alongside   \nWorks with node 8+  \n*Yarn support was not heavily tested across versions*\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--yarn switches to yarn instead of npm.\n--migrate forces migration to the new audit-resolve.json file and format even if no modifications are made to decisions\n--mock used in tests\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n### Running in CI\n\nOne of the problems npm-audit-resolver solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n## Features\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n- Further in the future - because a maintainer you trust has checked and the vulnerability in their dependency tree that you pulled is not affecting the package you're using\n","readmeFilename":"README.md","gitHead":"fdf1ca4462631f1240a3c534e1e86af20964f096","_id":"npm-audit-resolver@3.0.0-1","_nodeVersion":"16.2.0","_npmVersion":"7.13.0","dist":{"integrity":"sha512-qzew43Oo2+Fd7fLufM/PBwzM24/jtgdUYtZH++6kFnCJI4o0fSDAp7MzvG8BV1SatXGzwwUDXtgjAG9vje86uQ==","shasum":"1a235b28183c4608707712cb0f519346aa9b163d","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-1.tgz","fileCount":35,"unpackedSize":256739,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJguBMZCRA9TVsSAnZWagAAPiYP/0octN6mPd5mXldPNXRG\nTBuX8DVc+z6eQhMphEXlbk89pazPRhQ7zrfpeMIyvBa9Z5DaQPEXyjSvKm95\nh2WE5HFeqBz0NC+ubq1a/Z8VjlqYt9GU7Os6VhpGfRE40fE+1jIhcb81U79H\n5NfwBabyE8VtG/jQsbFaaYgY0Zgo3V64MzcnT8YmU34SPMWoGzsN1LRs7xMV\nvbs9xvScO8EL/FR6AfF5tbinZKTDWikaeDVSDtfVO11+T519Z6WbXhF5xNpl\nEDkn4BhUbtlw28Ym4upvAGrNI9o5ADzbzfuyfXJljalaVrBlP6+eiCmxucPp\nQcfE6tXRm2WbPIwpfDJLvRWZBdXAugNoVgn/GaLLyXbDfPTNc96NqSD+sfUL\ncLW4TJdSwnEM9PLJllY5pGcZCbMjd8RATPix8Vv31o2j6eCHqmNB5xdFQfbU\nQuPY3s/HPIRJtsKLqUxxRVh2JxGC6cFWHC9gFBOKP5Xi0RaJe9UMKqt/Ll5s\n8GjyPPYCDJTpHznyoXNN8+iU8TpNPYY57b51i7KY6qued++AwLoi9D7qTuXd\nXQsLxDevvQ6x4KJKH0/0LffV3r4D1CVK1pjtlehLa63bC0oAi+oPvUevlpYP\nB6ls72zB8bWBbnnoE4Owl+ZcojWw40sslN2iYURPlA+3sEZ+mSuBNEDNAKVY\n7Dzw\r\n=EBQV\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIA57IYwDNVm+vXZGGtCsOXRSGOI7XXQ3OF2UIO1Tw+cSAiEAyO1sPn/Mvdi9EF4LkgkDT3uHGBU/ff4DYSfVOAkVn30="}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-1_1622676249177_0.1546553498715617"},"_hasShrinkwrap":false},"3.0.0-2":{"name":"npm-audit-resolver","version":"3.0.0-2","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":"sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^3.0.0-2","chalk":"^2.4.2","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^1.6.4"},"devDependencies":{"pre-commit":"^1.2.2"},"readme":"# audit resolver\n\nA tool for building a responsible but practical supply chain security practice.\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use.\n\n> I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. \n\nAudit resolver creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.  \nYou can decide what to ignore and for how long, or track what's been fixed before.  \nThe `audit-resolve.json` file sits in the repository and you can see who decided to ignore what and when.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)  \nI'm participating in [Package Vulnerability Management & Reporting Collaboration Space](https://github.com/openjs-foundation/pkg-vuln-collab-space) where I intend to donate parts of the audit-resolver's core.\n\n## 👷 🚧\nDue to changes introduced by npm7 the option to fix an individual package is not supported, temporarily - while I work it out.  \nYou can run `npm audit fix` after marking all relevant issues as fixed.  \nI'm considering putting a fix-all in place that'd run the fix on entire node_modules and mark all fixed items when done. Feedback welcome!\n## Install\n\nRequires npm v6.1.0+ or yarn installed alongside   \nWorks with node 8+  \n*Yarn support was not heavily tested across versions*\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--yarn switches to yarn instead of npm.\n--migrate forces migration to the new audit-resolve.json file and format even if no modifications are made to decisions\n--mock used in tests\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n### Running in CI\n\nOne of the problems npm-audit-resolver solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n## Features\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n- Further in the future - because a maintainer you trust has checked and the vulnerability in their dependency tree that you pulled is not affecting the package you're using\n","readmeFilename":"README.md","gitHead":"51cbb33562bb518a8e84df5056bc41f064fb33fe","_id":"npm-audit-resolver@3.0.0-2","_nodeVersion":"16.2.0","_npmVersion":"7.13.0","dist":{"integrity":"sha512-W/wKmv5ynw/uNkgwf1qXB4wCCRWw6QVYmqIad6OuBNGXQGD4ZzMIydatf3oJttCFGlIvqPvjAZsNRPF+dnSOtg==","shasum":"de21f1f726c5a3d171547152acdb2118e09caba7","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-2.tgz","fileCount":36,"unpackedSize":282024,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJguoVtCRA9TVsSAnZWagAAYFcQAJMf4aasVyvJjpHnUhFr\nuFE9XrHMaV/4xr8Ttp6UF7ugQdHqp38CnDWCSWkcMKyj+4Cj0UoL3imQqu4Q\nOjSpDvRg9T7yR+CJM6fSuu3Cv7zHogRsUccN8yPAWYob0HkVNPcqn0PimYZ3\nWhJVBKP/IF5VL7mCqoODByrCqujJ18J6q0tYzEeSZh3LcK49I4v9PWdjI4YA\nnAbIanevx3wq3JKm32lOSLbkeMiajvjFwYonJ/knNZiibxMuS8M6bqsenII2\nT83LLEcqahBmPkpzcVd4df70FdnRCFgUrQL28VarkwUnYKqt7/TrRYE2yJBK\nUt6eUTc4Z5ckcHKQxiS69DuziyGiuy1x2Moym8nRfCU4kX8TvZ+f6KICul0B\nkGz3VW5X/dX/BfJnlmXMg1i1Q3HRtTPcXIG0knevnZ/xmkngSlwcb91CbaY5\nl36pxd10JtvGqgEh9cUFHuj7wvfFHL0cnuIwTIVKmsjxwBkF3YpbYni9+OR1\njblW+FDFZvdPQFYqsf+L6N/yPXnLUxll2rrrYexkvmLGXWD8eVi8q6474fUm\n9MqpAc7zHO5yxx545uQ7Us2ZP81Fegu79x+OGjXitVoUQKPEreWbY9bPy8O9\n7Wb/Vc2lUgPeyJjG+JmnzUCfodpJheFjwFF306vYmI/JtoCFfc5IlGb1e6S0\nt0aD\r\n=gW67\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQCszerydbTsieBg/NC9XHDu5Xfg295uutgzo7jGPs4DGwIhAPl+Odft+Ard+0fMSzT1WOEjwsJUyobfe9GUIA461AQ7"}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-2_1622836589492_0.44905501303275375"},"_hasShrinkwrap":false},"3.0.0-3":{"name":"npm-audit-resolver","version":"3.0.0-3","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":" node test/e2e/test.js && sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^3.0.0-2","chalk":"^2.4.2","concat-stream":"^1.6.2","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^1.6.4"},"devDependencies":{"pre-commit":"^1.2.2"},"readme":"# audit resolver\n\nA tool for building a responsible but practical supply chain security practice.\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use.\n\n> I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. \n\nAudit resolver creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.  \nYou can decide what to ignore and for how long, or track what's been fixed before.  \nThe `audit-resolve.json` file sits in the repository and you can see who decided to ignore what and when.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)  \nI'm participating in [Package Vulnerability Management & Reporting Collaboration Space](https://github.com/openjs-foundation/pkg-vuln-collab-space) where I intend to donate parts of the audit-resolver's core.\n\n## 👷 🚧\nDue to changes introduced by npm7 the option to fix an individual package is not supported, temporarily - while I work it out.  \nYou can run `npm audit fix` after marking all relevant issues as fixed.  \nI'm considering putting a fix-all in place that'd run the fix on entire node_modules and mark all fixed items when done. Feedback welcome!\n## Install\n\nRequires npm v6.1.0+ or yarn installed alongside   \nWorks with node 8+  \n*Yarn support was not heavily tested across versions*\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--yarn switches to yarn instead of npm.\n--migrate forces migration to the new audit-resolve.json file and format even if no modifications are made to decisions\n--mock used in tests\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n### Running in CI\n\nOne of the problems npm-audit-resolver solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n## Features\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n- Further in the future - because a maintainer you trust has checked and the vulnerability in their dependency tree that you pulled is not affecting the package you're using\n","readmeFilename":"README.md","gitHead":"92bb3be1c4919a851080cdaccb3fe42ff74c7095","_id":"npm-audit-resolver@3.0.0-3","_nodeVersion":"16.2.0","_npmVersion":"7.13.0","dist":{"integrity":"sha512-BA/09Lwpn5T6Z3lfgSrT5JyD5Z/vauiaxXSYuJ4+kjFqmuPdePf+d+Y+6oTL/yfeykNqNlKA+jeettWZpukp8A==","shasum":"dfd7f0d8265981a7c5c1c61be15ca238c6c90f96","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-3.tgz","fileCount":37,"unpackedSize":282647,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJgwnefCRA9TVsSAnZWagAAJqYQAJdzf+3zXgp2x6HRy3WQ\nr/EkA0dVDVJ4PCpSvNwIE+vE/MS+fss4om3FoOGEr1+cCKrF3jeT+cRE0tPP\no8bVXbT/XqjaLPOPIt99c/gh/vuYOlA9dW9eXY/G1/P54KSpOJ96EvMZSzWC\nHjHdvLDjt61K2K5kX9LUV3TFPV3idXEz3LZd8+sDkviiP7wN1pZVw9ZK0mif\n5SbxaVaYkhzvTuZmqWkmQlBlVtSf2hyW1UYPqkKRObqefs6do1CuQXDD51A6\nespqC64Q36kjZBDIW99TxHQT8yrLhxIJaTVz+2CKs2X8fjaXEa24awZP9H5L\nFVvfkxy/tubGg9JSGtYPUDuzmZYxAVJf4tRmyOAM8xc89Pdt4z/nLmnuNYeZ\neJH20CuvG/9wcPAq/OBOwtC63ruvxfpdoif02A/7633dEwNgMN3anPoTiawr\nORT5ALNHFRKxKYjS4Q3FpGd1R5/k2cRlU4Z4R0jRn+BOqXASTeaSIudcsjR5\nWQO4unLPOq7GJgwW3QxR1bfSI08mfQNsinhEhqZf7mdtT6TG88NSG8gUKWHJ\nur9PbQa2FmYGjjOyMuyfvEcndWL26WNsKJNzUD+icFILc8dyE52GFvophVXv\nuZ8LnyZyqYutafx6um+wNCW3/yw4n+D6kcSx3Gkm/L808rnVh1sIT9mj9tZc\nPlN9\r\n=IerB\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIBRos21GsB1tuTCu7fmw7eMt9wNWpnF5XxCNp4OMa41BAiBzVaPC4loB8W2Fl7kDhgjzGhBrawmQfxXnTx9VNF/S1g=="}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-3_1623357343341_0.6907945039933574"},"_hasShrinkwrap":false},"3.0.0-4":{"name":"npm-audit-resolver","version":"3.0.0-4","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":" node test/e2e/test.js && sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^3.0.0-2","chalk":"^2.4.2","concat-stream":"^1.6.2","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^1.6.4"},"devDependencies":{"pre-commit":"^1.2.2"},"gitHead":"795d6493e0ddc7a214e13c1c2a860778eaffcd81","_id":"npm-audit-resolver@3.0.0-4","_nodeVersion":"16.2.0","_npmVersion":"7.13.0","dist":{"integrity":"sha512-/tR3s7kIFJs1A2seSEpI/Y0dWkwnHbv3NckWd40j2SIATDFkZVsEhz2DE9gJ7r9vFHLFz/8FLRFzu7EiO3RAxA==","shasum":"61a7da7c155bcc9348145f47550712ce540ab452","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-4.tgz","fileCount":38,"unpackedSize":309435,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJg607sCRA9TVsSAnZWagAAlCQP/jD55ejOOfWZcj3zCz1D\nLUpXh7/+YASb7DSFT7Pu2DTrD5YGRKjTvxYV8LxA7WWyFI8JL4psB5QSUtBB\nSSrwZoTxMU/BP+AlDN9p4KV8MCdqCyf2plEgCYvTg9dr0giZ+Fsuf8O323Cm\nBkM6EBSLRd7L+Hd403zyICrawbJsbMc6X/jgCMg8lhPTnCO8EMtnFjcMBvgs\nCXGfW3Uqkh782znjJJD8fgGfsk1NrYhAY/Oj8OgIwOOENJ0YwYDIddgndH7I\nnkmRQqo87AjQ4fTEenhqXEkCAWKe8tfzZHmAfj7+v+2XGvBlWBZFoiKrn+g+\nnxF1BJB88wisvQqJAY3ORhy1ruCYOi9EbI+EY/tuThWa3NIX5v4c5QrleUhm\nWy+ufB4t90E4qb6xs+cHzQt8XoJ4C099orbGq+trzEjc8MFnkHewaEGQjqtX\n4JhhGqqk8ODgXjDkvt9GYkSW2jrksAYJiDblgPdjlY794SFzgYnf2W7wp+OR\nXrZ0vZ0lfFqJR8vbvLoFI5b28LS7oImU/rN1gAgpygwvF8TtZQZjcgoGj3y1\nKTvoOeQaIy5D5xAsWJ9aqwC0qRWIB2Q1mbvAw9w+TQqBx9RN6lM9BEx1CC5k\nDHsmtEL96UnrfAZ5UT0kYVnYuNua1v9+DjQOTPbDqVA31qpJRq+BcIYzZSX1\n7ZW0\r\n=xmd3\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIGOkHp88IiFq6v7SmA8lFtoSOn02HY4cetzO0jhHRgP/AiEA3hKLVriwC90giGc/KvhxYifPR5T3WIN3AusZ5cq1hIE="}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-4_1626033899731_0.028528662798156468"},"_hasShrinkwrap":false},"3.0.0-5":{"name":"npm-audit-resolver","version":"3.0.0-5","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":" node test/e2e/test.js && sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^3.0.0-2","chalk":"^2.4.2","concat-stream":"^1.6.2","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^2.0.0"},"devDependencies":{"pre-commit":"^1.2.2"},"types":"./index.d.ts","readme":"# audit resolver\n\nA tool for building a responsible but practical supply chain security practice.\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use.\n\n> I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. \n\nAudit resolver creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.  \nYou can decide what to ignore and for how long, or track what's been fixed before.  \nThe `audit-resolve.json` file sits in the repository and you can see who decided to ignore what and when.\n\n*This package is meant for early adopters. Anything can change, but my team uses it for maintaining over 20 apps so there's likely to be a migration path.*\n\nI'm working on getting it built into npm. See [the RFC](https://github.com/npm/rfcs/pull/18)  \nI'm participating in [Package Vulnerability Management & Reporting Collaboration Space](https://github.com/openjs-foundation/pkg-vuln-collab-space) where I intend to donate parts of the audit-resolver's core.\n\n## 👷 🚧\nDue to changes introduced by npm7 the option to fix an individual package is not supported, temporarily - while I work it out.  \nYou can run `npm audit fix` after marking all relevant issues as fixed.  \nI'm considering putting a fix-all in place that'd run the fix on entire node_modules and mark all fixed items when done. Feedback welcome!\n## Install\n\nRequires npm v6.1.0+ or yarn installed alongside   \nWorks with node 8+  \n*Yarn support was not heavily tested across versions*\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--yarn switches to yarn instead of npm.\n--migrate forces migration to the new audit-resolve.json file and format even if no modifications are made to decisions\n--mock used in tests\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n### Running in CI\n\nOne of the problems npm-audit-resolver solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n## Features\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- fix - Runs the fix proposed by npm audit and makes a note. If the same issue comes back because someone else on the team changed package-lock.json, you'll get a warning about that.\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n- Further in the future - because a maintainer you trust has checked and the vulnerability in their dependency tree that you pulled is not affecting the package you're using\n","readmeFilename":"README.md","gitHead":"58270f033bb413d9a9bb677e1250a9cbc8c1e618","_id":"npm-audit-resolver@3.0.0-5","_nodeVersion":"16.2.0","_npmVersion":"8.3.1","dist":{"integrity":"sha512-aNjNG4v1CoVG+iOTfAzaPGVGjeHNGl3+9RqrYlAuz98qwmq6tOOYNgNDwB7yLaLTM5BcL83u9p2MFJDxmRm7eA==","shasum":"fc2cc63d57d86c3d0d4297497a7efbee63b9756e","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-5.tgz","fileCount":39,"unpackedSize":309752,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJh4xL+CRA9TVsSAnZWagAAUFQP/jVadbOxlbvdIQa2G+Vm\nseps7IkQcK4Q1zwVn+Nrykvsp+j5Z6ERwoHatA8xwI/Ofustxy5wPXJk6Met\ne1TpAt3MKtgNCtKwB+apfU10mPoMeezax3efBHZwKKzxzIKyj2GkJPNz/wga\n2LKeLibLoRlQgjap3gmY/4bduuADiomw+1pztWXxbZVlAVXYN3l7ZaNcC/Wy\ngD4msCHZLfF/bMT2GoKvmkqPWWfOpCvFUGdoQKH1OzrTdp4icEt9jFeen8+H\nnKroFqoavQuCw4UCa3dbrQeLenbpA/w47qYVXUEhzIwt6pJA2V3SSktS3wJz\nIFun6rWyi+F2qnkB8IHQNyanvc4zrlUFeYyak8FuAHlW0luAoo2i7IH1EUIc\ndXFfC9hFgsDGRxfOAmqRz2qQTha7HETnsjwzFLEsymoSlVOpEtJsVmd7rZkX\nuGftkrboXGhOQXphTerllQujHjudcBvAjSH3Rc+ENVAXe/+NZNnMTo2bpNxo\nO3yBCdjDR6fVHpAPTrKYOtCymU1DruRHtfcdx6rXW7demO/TnPVo/uEQarqL\ntmyuRI9VEww+S4HL1Gvi4YnFTuuvT5yFBxMTug0MyVMvZEPcqL2jkX3f9Prg\nEIHS7H+0A6TgHKi4qI5LPUVSQYs3hWyIAorRRk3oUwhRU7JN3kg1GvUjBEoP\nG2pk\r\n=+hc1\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQCRhG2YvisZ6KdgSpIIpnerweUF8JMVw3Ey0FowU6nHdwIhAKW1hk088E62E4HFQdWXbSrtgoGUaAdN1XglKGIysaGt"}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-5_1642271486374_0.6944522894019389"},"_hasShrinkwrap":false},"3.0.0-6":{"name":"npm-audit-resolver","version":"3.0.0-6","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":" node test/e2e/test.js && sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^3.0.0-3","chalk":"^2.4.2","concat-stream":"^2.0.0","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^2.0.0"},"devDependencies":{"pre-commit":"^1.2.2"},"types":"./index.d.ts","gitHead":"a702a4f23760ed54a5d73d2ad48243a12d6f7d1c","_id":"npm-audit-resolver@3.0.0-6","_nodeVersion":"16.13.2","_npmVersion":"8.3.1","dist":{"integrity":"sha512-+6Zsbg8lcM+eF7uap/B77JC9D+suuLSW9CIfdgxlc5EdbUSDd+p6lIJO3Mdc2f9wnNQEnf/9O/tKHpBtd72bPw==","shasum":"4d357becafcfcbc453e8e5bb7c01d8277d2a13b0","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-6.tgz","fileCount":39,"unpackedSize":309752,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJh+QOICRA9TVsSAnZWagAAIngP/339gHIIZYtraeT/yyyg\nzPn9Eng2t7jZyYAjeD0R+bIR1hIQ/SKzvcs3LdFOrA/h6PKLO79Zf5MriOyi\nmthc/wGflp1BW58Cc7ixqC2pWRjg++lIr1BMaKC5yM33hLrvjmJRIlYjvPtb\nvDOo1p786zpk1f1gGzJ3q/o7VxsirvxTfdQED1RvmrmZO0I5510fxrwNt0zt\nERUpyy6zTFTL7oUY2lNbZptpi/hElJTEFDqLC6GwuBK+m0KIAdVHaSWuATWO\nanik35LCj3u83yrv8DnN7zTI9iwTHGfU89y2OY5yH0U3NJZ92RLxYk6dFgLz\nKq/HBaQPacp7RwsMIEPt8HmM1W6DYdgEWx6XsbUkq9UKvCH6ijYwGKRqOx6l\n2npRitSaRF0lmKa1nwYsJMSVew+uNFEELAuHKlPTEXdol6wysqMbmcQaznTS\nmRJAeAaPlk9Yg/ylxxvcDaZ0g3CGk8Qe8Gy1uEq2ZdPWOhOcGDs/58X56g75\ngm6N+jhe2x8U+jQLaubRCCD2klIfJhTfvTR3EhW2dZspgIO67k+XbqpWNUKF\nKzJbzDOQhAJcX1xHj4E4zqAOdEpr0XNUDuf2rjO8SfK4VsRTp1bdZUWmqp77\nrRtLCM9pezxuYfvfWyfJdUZOhufa3gx8iomhcCY9+jClRE5SFx5/6YZ4jeqO\nskqY\r\n=2KTj\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIG7heTvSm7VXrlg69ZtPi2ZLk5/TctifOUN8W626QjIOAiEAuqusok+ZjIzDvDWcTg0Lb83cqxs4D3e251uzrdOMGzQ="}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-6_1643709320291_0.5107550783571433"},"_hasShrinkwrap":false},"3.0.0-7":{"name":"npm-audit-resolver","version":"3.0.0-7","description":"Aids humans and automation in managing npm audit results","bin":{"resolve-audit":"resolve.js","check-audit":"check.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":" node test/e2e/test.js && sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","nsp","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"audit-resolve-core":"^3.0.0-3","chalk":"^2.4.2","concat-stream":"^2.0.0","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^2.0.0"},"devDependencies":{"@npmcli/arborist":"^5.0.0","pre-commit":"^1.2.2"},"types":"./index.d.ts","readme":"# Audit Resolver\n\nA tool for building a responsible but practical supply chain security practice.\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use.\n\n> I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. \n\nAudit resolver creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.  \nYou can decide what to ignore and for how long, or track what's been fixed before.  \nThe `audit-resolve.json` file sits in the repository and you can see who decided to ignore what and when.\n\nI'm participating in [Package Vulnerability Management & Reporting Collaboration Space](https://github.com/openjs-foundation/pkg-vuln-collab-space) where I intend to donate parts of the audit-resolver's core.\n\n## Changes in version 3\n\nDue to changes introduced by npm7 the option to fix an individual package is no longer available from npm and wasn't always working correctly anyway. By virtue of \"doing one thing and one thing well\" this package will no longer provide that option. \nYou can run `npm audit fix` before running the interactive `resolve-audit` command.\n\nRequires npm v7.24.2+ or yarn 1 installed alongside    \nWorks with node 12+ (could run on older, but my dependencies dropped them)  \n*You can use audit recolver v2.x with npm6*  \n*Yarn support was not heavily tested across versions*  \n## Install\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--yarn switches to yarn instead of npm.\n--migrate forces migration to the new audit-resolve.json file and format even if no modifications are made to decisions\n--mock used in tests\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n### Running in CI\n\nOne of the problems npm-audit-resolver solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n## Features\n\nWhen a vulnerability is found, you get to choose between the following options:\n\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n- Further in the future - because a maintainer you trust has checked and the vulnerability in their dependency tree that you pulled is not affecting the package you're using\n","readmeFilename":"README.md","gitHead":"f7fff1cd4b0619d2a07cceda96def01096b7dda6","_id":"npm-audit-resolver@3.0.0-7","_nodeVersion":"16.14.0","_npmVersion":"8.3.1","dist":{"integrity":"sha512-6mXix6DOeiJxZ/vJKA5xkyPPO0ocRj8ZFPdockd0vO7woQbRdAnBdK5JXCpnGxrTW/ND7X6XcbYrWvWdxYoVng==","shasum":"5702bab558f2a66e21f2712879a4985693a7ac7a","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-7.tgz","fileCount":39,"unpackedSize":307689,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v4.10.10\r\nComment: https://openpgpjs.org\r\n\r\nwsFzBAEBCAAGBQJiGpPSACEJED1NWxICdlZqFiEECWMYAoorWMhJKdjhPU1b\r\nEgJ2VmpvgQ/+JtwuAIMAzNa6tmf/ir7eg9L3zb4Hs9p9+nopPMMa6tOOtpVU\r\nlwfs4D3QCsPUblU0yuqp6Ec4Cp8rxaBQin8QO6f/k9m4JtUy80dHVpgw00Fa\r\numRqK0AKRtZebWq+HVxUKzRAJv1ezQd4STz7MsHZPaaGu1Kud+9i+oiSDb9D\r\np/UWt13EWGIdKBEARiGVPyDdZE6QtKIbAdOz+VjX9J8pl5BQiJszkkSGTtpn\r\nxQk+OPx8jDpo0Ou60iU3zBq53grzCblxVi/sdFYXjNnQVZCwIwzAyILDbG95\r\nGKfesaZc14TpbQB3qGOChuyYvC/DYfv8roDxAG3kIuZzLlHJbWX8iIUpY8hZ\r\nn8ZXyM29Frp9oUIjg7rPfifaja3FvsaUZsoBVWaGz06p0OKVdoFOhfB8XZSg\r\nu+4A612ukvrVszO009GH+z6lcyoga3c87slblM+7l0Ov+wJ5Q/VLeA27rN3p\r\nk/4NEb51n7IHcuLp8/YijcNMGeDE4rkRduRjamZIr7N+wfIYQZLyXZD9oBuT\r\n4kWzLX/enOW6Tv9LgeO8vdv/UWfVafwu5WcsweSa0dPLnaI5Otgcy/2AA6gE\r\n6koYl7gJTRTP0Zz+5Mu6yjDmiii1NlJ96MKWe/vYTCy9gYxESBcG/ILF5+pV\r\nXLweBy2vxlSaAE/WPx/OBg5VDyv5owNYrdU=\r\n=6/vl\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIGxM1NzjtQFN/ekaji4rDENzFxROzapq2EK0xhceCAjUAiBkdvFBMaq1HFYXzfAlCjzv4wR8FJ+OVuW8o080/53oOQ=="}]},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-7_1645908946501_0.29390141305956985"},"_hasShrinkwrap":false},"3.0.0-8":{"name":"npm-audit-resolver","version":"3.0.0-8","description":"Aids humans and automation in managing npm audit results","bin":{"check-audit":"check.js","resolve-audit":"resolve.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":" node test/e2e/test.js && sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","supply chain","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"@npmcli/ci-detect":"^3.0.2","audit-resolve-core":"^3.0.0-3","chalk":"^2.4.2","concat-stream":"^2.0.0","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^1.0.7","spawn-shell":"^2.1.0","yargs-parser":"^18.1.3","yargs-unparser":"^2.0.0"},"devDependencies":{"pre-commit":"^1.2.2"},"packageManager":"yarn@1.22.19","types":"./index.d.ts","readme":"# Audit Resolver \n\n![](https://img.shields.io/npm/v/npm-audit-resolver.svg)\n![](https://img.shields.io/static/v1?label=finally&message=released&color=green&style=flat-square)\n\nA tool for building a responsible but practical supply chain security practice.\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use.\n\n> I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. \n\nAudit resolver creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.  \nYou can decide what to ignore and for how long, or track what's been fixed before.  \nThe `audit-resolve.json` file sits in the repository and you can see who decided to ignore what and when.\n\nI'm participating in [Package Vulnerability Management & Reporting Collaboration Space](https://github.com/openjs-foundation/pkg-vuln-collab-space) where I intend to donate parts of the audit-resolver's core.\n\n## Changes in version 3\n\nDue to changes introduced by npm7+ the option to fix an individual package is no longer available from npm and wasn't always working correctly anyway. By virtue of \"doing one thing and one thing well\" this package will no longer provide that option. \nYou can run `npm audit fix` before resolving unfixable issues. `resolve-audit` will offer you that option first before asking any questions about specific issues.\n\nRequires npm v7.24.2+ or yarn installed alongside    \nWorks with node 14+ (could run on 12 and npm6 but no guarantees going forward)  \n*You can use audit resolver v2.x with npm6.*  \n*Yarn support was not heavily tested across versions, but works well with current yarn 1 and 3 at the time of writing*  \n\n## Install\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--yarn switches to yarn instead of npm.\n--yarn-berry switches to yarn2 or yarn3 instead of npm.\n--migrate forces migration to the new audit-resolve.json file and format even if no modifications are made to decisions\n--mock used in tests\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n### Running in CI\n\nOne of the problems npm-audit-resolver solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n## Features\n\nIf `npm audit fix` can help, you'll be prompted to run it first. \n\nFor all vulnerabilities found, you get to choose between the following options:\n\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n- Further in the future - because a maintainer you trust has checked and the vulnerability in their dependency tree that you pulled is not affecting the package you're using\n","readmeFilename":"README.md","gitHead":"ed1fd44e82a113cbb596210b7ae3d82c0b82daa9","_id":"npm-audit-resolver@3.0.0-8","_nodeVersion":"19.6.0","_npmVersion":"9.4.2","dist":{"integrity":"sha512-qgLCFwIgXqMiVUSVVqr28HaEcjvPpFUQwZoWJ0D/l9AmqjRG3/inAjb+SEATpKRbh4zhXKaKOaq+d8V3QA8dKA==","shasum":"bd0d7c465c446fff1a6c13309621f8b1ade0d731","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-8.tgz","fileCount":22,"unpackedSize":48048,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDEW210XKR/iOF5oWkH9BK+wl0qDGw9rmUBUORgbScCqwIgF7lgylp0pvRWPq5nz9M8IS8DPxQtorqoHkPGNBQhpnY="}],"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v4.10.10\r\nComment: https://openpgpjs.org\r\n\r\nwsFzBAEBCAAGBQJkANJLACEJED1NWxICdlZqFiEECWMYAoorWMhJKdjhPU1b\r\nEgJ2Vmo4Ig/9E36f0A1ojBRGurI/xR0fHi/SxVvRak/4nMKtakab1mgPT4NL\r\nyS3fhKXSPj1RzawkVwI2xyTHWoSrexob+us53/7x03K4Anu5Yc9DGj+TmLQ8\r\njid15+jOnl3am6RxN/byJjQIt/50oWF9T8QMM8kjGjvEQaEYFt7AcwuZVHro\r\nHPLjhfpUx/lzufFUbuM9w/vGvQsIEaCrFgXE8R+3vYoWRltVZGO642gBOSNy\r\nH/9BlC9Vz9pFrrAlt7DmA5sdAuNGWEOZmwwr6nRxUGWqTu+iucEkyYCOajEX\r\n0EM7T8Rts+7o8HiLiisGTzehlfiV6PE9UYTir8VEoxxHCaKWypSY6Psh+/MW\r\nroEANERyA5xuRb5JuJ44JlGGKjYwC4er4wkCu4zNZhdbiDUiYyaxMaof8mQf\r\ncxsZnTacZX+GikzBnOMMyBZWxQLITJSyjEtnpqTOP/XUfa4IvwEBJZTm3vWy\r\nNRFiO4rm7vkG5h8SY8tgIgLh9Gim0b/eQnPId1aNjkfqkfWrBU+i3ZFxrcfO\r\nOy1694Ab3qQk+zSXX77Nt2QUESTkiTZXAtshLasaD17A+OGnhM24eZal7a7v\r\nk6Nquf3VBn068Wc48h4Dv27eT1nbzXiV8nVBH6b9Kz4XodghXl+lhdvfwYvf\r\n6+yXK7ajVKI1+vIuu1yWpAb07TWusfH8kA0=\r\n=BPbk\r\n-----END PGP SIGNATURE-----\r\n"},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-8_1677775435614_0.7902001193138593"},"_hasShrinkwrap":false},"3.0.0-9":{"name":"npm-audit-resolver","version":"3.0.0-9","description":"Aids humans and automation in managing npm audit results","bin":{"check-audit":"check.js","resolve-audit":"resolve.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":" node test/e2e/test.js && sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","supply chain","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"@npmcli/ci-detect":"^3.0.2","audit-resolve-core":"^3.0.0-3","chalk":"^4.1.2","concat-stream":"^2.0.0","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^2.0.0","spawn-shell":"^2.1.0","yargs-parser":"^21.1.1","yargs-unparser":"^2.0.0"},"devDependencies":{"pre-commit":"^1.2.2"},"packageManager":"yarn@1.22.19","types":"./index.d.ts","readme":"# Audit Resolver \n\n![](https://img.shields.io/npm/v/npm-audit-resolver.svg)\n![](https://img.shields.io/static/v1?label=finally&message=released&color=green&style=flat-square)\n\nA tool for building a responsible but practical supply chain security practice.\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use.\n\n> I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. \n\nAudit resolver creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.  \nYou can decide what to ignore and for how long, or track what's been fixed before.  \nThe `audit-resolve.json` file sits in the repository and you can see who decided to ignore what and when.\n\nI'm participating in [Package Vulnerability Management & Reporting Collaboration Space](https://github.com/openjs-foundation/pkg-vuln-collab-space) where I intend to donate parts of the audit-resolver's core.\n\n## Changes in version 3\n\nDue to changes introduced by npm7+ the option to fix an individual package is no longer available from npm and wasn't always working correctly anyway. By virtue of \"doing one thing and one thing well\" this package will no longer provide that option. \nYou can run `npm audit fix` before resolving unfixable issues. `resolve-audit` will offer you that option first before asking any questions about specific issues.\n\nRequires npm v7.24.2+ or yarn installed alongside    \nWorks with node 14+ (could run on 12 and npm6 but no guarantees going forward)  \n*You can use audit resolver v2.x with npm6.*  \n*Yarn support was not heavily tested across versions, but works well with current yarn 1 and 3 at the time of writing*  \n\n## Install\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--yarn switches to yarn instead of npm.\n--yarn-berry switches to yarn2 or yarn3 instead of npm.\n--migrate forces migration to the new audit-resolve.json file and format even if no modifications are made to decisions\n--mock used in tests\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n### Running in CI\n\nOne of the problems npm-audit-resolver solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n## Features\n\nIf `npm audit fix` can help, you'll be prompted to run it first. \n\nFor all vulnerabilities found, you get to choose between the following options:\n\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n- Further in the future - because a maintainer you trust has checked and the vulnerability in their dependency tree that you pulled is not affecting the package you're using\n","readmeFilename":"README.md","gitHead":"f99e22b1342eaa6efb749551196b7adffe380783","_id":"npm-audit-resolver@3.0.0-9","_nodeVersion":"19.6.0","_npmVersion":"9.4.2","dist":{"integrity":"sha512-jyFAobYz/hv5cpxDicB8O9sIj3dD1htinFpIF26CFkYzlAR4CXJvs051tstlgcYYQZ+Rf6ymnBUdkjmSkML8dA==","shasum":"c6bfa14b3363dce81f322ca7516d4eb61c27c9f5","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-9.tgz","fileCount":22,"unpackedSize":47804,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIB38Tk+A3EJRIyJVs2E3bEHLAqHyBu964f/FANy3P6QyAiEAt9CbZu4lwBSmRKURd/dwW+36kdTfV6YGoPmTRwXkNQ0="}],"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v4.10.10\r\nComment: https://openpgpjs.org\r\n\r\nwsFzBAEBCAAGBQJkAQABACEJED1NWxICdlZqFiEECWMYAoorWMhJKdjhPU1b\r\nEgJ2VmqrLQ//fGOLpnkfukjwk44o2DbTYF+0b86jZ7RFXKA3qv2CKL93WYBF\r\nbJU8NQk452m0fp0ui4/6DS1lWjKHgMgzlRLmtz6lYEridKQJnGYe/vP+7GP4\r\nsWJ2MJaiH8DD2pwNASA4MMGG3lApZMcZhR5vl4Gb7hrWmQXp97sX0GUuu3C/\r\n2/ub/nDCjw5Impgt+9Mduxr1ofAa5aX+97538Rm/5YahkQOE6pKkaJlN250T\r\nPJsEt8D5To2pFtqhbfjpHwWb1QjZzN0Qma1DFVbpPDPxCL2qR37GD/lorjQV\r\nMbMqWxgSkNWhXnOnsqz7q+IXLFYPTjNPsmH7l0bWOVOziTxnkGLwuEPRe2zc\r\n3950k23TI0ygbYj73WKEFJVU1H5krwIbXhIU3L6XJDgiwIoqEa9+eO3x7efI\r\nZWo3XsF3vFtpVvBcQL8dY02gbsjKkB3vTm1LXSQHNWRdkzUNky5tC7WmIcnj\r\nulSvbq46dcxQ/t9ir95/tGHw5dAYM8MLXn1Oa1LGmDmNt5hYgeF1kIDI3uVX\r\npEL6JjE3xA1Qt+0KqG/zKGlAjKgwqTriU6l/ShwmbOK+2lCQJgSLl87ca1HS\r\n52JcONYlmcwpM3Nd9+oFbZL02/e8E3DA13Ukpn3b84sw2i7BYXMcNLs3ds9+\r\nFuruzPBM7j2tHxpF8eRkrqqv8giJqsUZg1s=\r\n=DeKt\r\n-----END PGP SIGNATURE-----\r\n"},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-9_1677787137551_0.10510121893044344"},"_hasShrinkwrap":false},"3.0.0-RC.0":{"name":"npm-audit-resolver","version":"3.0.0-RC.0","description":"Aids humans and automation in managing npm audit results","bin":{"check-audit":"check.js","resolve-audit":"resolve.js"},"main":"index.js","scripts":{"add-vulns":"npm i -D base64url@2.0.0 lodash@2.0.0 dependo@0.2.0","rm-vulns":"npm rm -D base64url lodash dependo","test-exec":"rm -f audit-resolv.json && ! node check.js && node resolve.js && node check.js","testdrive":"npm run add-vulns && rm -f audit-resolve.json && ! node check.js && node resolve.js && node check.js && npm run rm-vulns","test":" node test/e2e/test.js && sh test/e2e/test.sh"},"keywords":["npm","audit","security","dependencies","supply chain","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"},"homepage":"https://github.com/naugtur/npm-audit-resolver#readme","license":"Apache 2.0","dependencies":{"@npmcli/ci-detect":"^3.0.2","audit-resolve-core":"^3.0.0-3","chalk":"^4.1.2","concat-stream":"^2.0.0","djv":"^2.1.4","jsonlines":"^0.1.1","read":"^2.0.0","spawn-shell":"^2.1.0","yargs-parser":"^21.1.1","yargs-unparser":"^2.0.0"},"devDependencies":{"pre-commit":"^1.2.2"},"packageManager":"yarn@1.22.19","types":"./index.d.ts","gitHead":"d450b30d14c0c99c89c172e0d8b1449d8cb59767","_id":"npm-audit-resolver@3.0.0-RC.0","_nodeVersion":"19.6.0","_npmVersion":"9.4.2","dist":{"integrity":"sha512-UuVC7HIxGMhkGfj6IcilBO0cbAz/Y1OhRHA49g3ccpyHDy6Bpd4nkPnLe+xuyZmTgUjiac509IIN3YPVdJZ0Hw==","shasum":"05c34e7102152aade482571b8225b94c06ed7da8","tarball":"https://registry.npmjs.org/npm-audit-resolver/-/npm-audit-resolver-3.0.0-RC.0.tgz","fileCount":22,"unpackedSize":47807,"signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQCAEATipZ0v/jp6CwR8qKdUUJo+gXAC+B3XlyS35/bfqAIgbTU80XZom5sTzFbpebT+0MI2iM7rTzCRUMn7kDB1/bE="}],"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v4.10.10\r\nComment: https://openpgpjs.org\r\n\r\nwsFzBAEBCAAGBQJkOlTgACEJED1NWxICdlZqFiEECWMYAoorWMhJKdjhPU1b\r\nEgJ2VmrPaw//X1rdPmHOw3l+I2cVi76gezFJqa0N1TqOt+qeb41RY1hRbznl\r\nCBBHg9MnRezCU2Ykc9fL6JeuKgwg/2r9zIKEbYmFJR1Oef0kXdnsL/Pd4Kz5\r\nRirrEFYh8TPpK1g+MgYb9xJ4KlcgGwdo2ToPbGYzCNZlCu0trAKI505VNaSj\r\n16p65ZkihiRlWzX5HCp91VAGJHqLUcaCyGZdV8UlCnyKN/LpbOT58VpDKSyN\r\nTAhmfWOGyiUu0MDmDJueI18/Zsa9B+9BCBzzn2YsoctIWY4Bc0e0pnEn6gZK\r\n49hu4SSdwZYiA8usloiaOtUwJQDHV8Xqvie1jTlLZv62gvkYm/6vgaqrVsMP\r\n/6BccfWy4waSLD0VQ+wIKSfjkedxM9342aFwRGlyhpU/qZuuBWZpMNoibqHK\r\noHlzBU0H5au8Y09JVBI4MXfsYBiK9CvbpcnTCKrKAebzlvbJInVMnq8SCEy0\r\npNvMFL9mgU151W6KbXPSX+rmospdGTGZhQkqYDEJOfmh9rL75REXz+O/Lo8K\r\nNW/OhvsK7K9r6lnKjAT5hNITEkg7mvSTy0KhGZomGm7CkFk0Jn+5NnnHKU6D\r\n1qur4u0YUBdTH7ZfaErceM7tgzfN3s6eF6ZwsMGSTch3ZY2++gWWtJgAcBCI\r\ny4P32RtElfk3FFdEUtzg/onlt+X3B2vmr88=\r\n=08T+\r\n-----END PGP SIGNATURE-----\r\n"},"_npmUser":{"name":"naugtur","email":"naugtur@gmail.com"},"directories":{},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/npm-audit-resolver_3.0.0-RC.0_1681544416102_0.1398151516070505"},"_hasShrinkwrap":false}},"time":{"created":"2018-05-24T09:38:04.127Z","1.0.0":"2018-05-24T09:38:04.174Z","modified":"2023-04-15T07:40:16.419Z","1.0.1-0":"2018-05-24T10:25:17.135Z","1.0.1":"2018-05-24T11:17:20.296Z","1.0.2":"2018-05-24T11:36:36.221Z","1.1.0":"2018-06-04T09:48:43.385Z","1.1.1":"2018-06-04T12:22:42.449Z","1.1.2":"2018-06-05T07:33:10.463Z","1.1.3":"2018-06-05T09:26:39.535Z","1.1.4":"2018-06-05T13:25:08.545Z","1.1.5":"2018-06-05T14:00:53.340Z","1.1.6":"2018-06-05T19:22:49.712Z","1.1.7":"2018-06-05T19:26:46.636Z","1.2.0":"2018-06-16T10:28:27.652Z","1.3.0":"2018-06-20T22:46:51.068Z","1.3.1":"2018-06-20T22:55:18.715Z","1.3.2":"2018-08-06T19:20:12.468Z","1.3.3":"2018-10-02T07:26:04.729Z","1.4.0":"2018-11-16T07:37:02.008Z","1.4.1":"2019-02-26T23:34:20.629Z","1.5.0":"2019-03-19T09:27:28.866Z","2.0.0-0":"2019-08-02T21:02:42.695Z","2.0.0-1":"2019-08-02T21:31:09.622Z","2.0.0-2":"2019-08-04T17:57:17.234Z","2.0.0-3":"2019-08-05T19:20:32.746Z","2.0.0-4":"2019-09-19T09:46:57.658Z","2.0.0-5":"2019-09-22T20:57:41.741Z","2.0.0":"2019-09-24T21:20:35.358Z","2.0.1":"2019-09-26T08:16:43.954Z","2.1.0-0":"2019-10-01T07:15:00.730Z","2.1.0":"2019-10-24T13:02:53.965Z","2.2.0":"2020-01-23T23:28:43.151Z","2.2.1":"2020-07-15T19:27:31.727Z","2.3.0":"2021-05-07T19:40:01.694Z","3.0.0-0":"2021-05-27T21:00:42.832Z","2.3.1":"2021-05-31T12:51:31.936Z","3.0.0-1":"2021-06-02T23:24:09.299Z","3.0.0-2":"2021-06-04T19:56:29.740Z","3.0.0-3":"2021-06-10T20:35:43.565Z","3.0.0-4":"2021-07-11T20:04:59.909Z","3.0.0-5":"2022-01-15T18:31:26.577Z","3.0.0-6":"2022-02-01T09:55:20.478Z","3.0.0-7":"2022-02-26T20:55:46.685Z","3.0.0-8":"2023-03-02T16:43:55.798Z","3.0.0-9":"2023-03-02T19:58:57.836Z","3.0.0-RC.0":"2023-04-15T07:40:16.305Z"},"maintainers":[{"name":"naugtur","email":"naugtur@gmail.com"}],"description":"Aids humans and automation in managing npm audit results","keywords":["npm","audit","security","dependencies","supply chain","check","resolve"],"author":{"name":"naugtur","email":"naugtur@gmail.com"},"license":"Apache 2.0","readme":"# Audit Resolver \n\n![](https://img.shields.io/npm/v/npm-audit-resolver.svg)\n![](https://img.shields.io/static/v1?label=finally&message=released&color=green&style=flat-square)\n\nA tool for building a responsible but practical supply chain security practice.\n\n`npm audit` is great. `npm audit fix` is also there if you didn't know. But not everything can be fixed right away and you need to manage your security and make decisions about the dependencies you use.\n\n> I built audit-resolver after a few weeks of trying to run audit as a step in CI and failing each time there's a vulnerability. There were just too many irrelevant or unfixed ones and my team needed a way to manage the situation. \n\nAudit resolver creates a `audit-resolve.json` file in your app and interactively helps you manage security of your dependencies.  \nYou can decide what to ignore and for how long, or track what's been fixed before.  \nThe `audit-resolve.json` file sits in the repository and you can see who decided to ignore what and when.\n\nI'm participating in [Package Vulnerability Management & Reporting Collaboration Space](https://github.com/openjs-foundation/pkg-vuln-collab-space) where I intend to donate parts of the audit-resolver's core.\n\n## Changes in version 3\n\nDue to changes introduced by npm7+ the option to fix an individual package is no longer available from npm and wasn't always working correctly anyway. By virtue of \"doing one thing and one thing well\" this package will no longer provide that option. \nYou can run `npm audit fix` before resolving unfixable issues. `resolve-audit` will offer you that option first before asking any questions about specific issues.\n\nRequires npm v7.24.2+ or yarn installed alongside    \nWorks with node 14+ (could run on 12 and npm6 but no guarantees going forward)  \n*You can use audit resolver v2.x with npm6.*  \n*Yarn support was not heavily tested across versions, but works well with current yarn 1 and 3 at the time of writing*  \n\n## Install\n\n```\nnpm install -g npm-audit-resolver\n```\n\n## Usage\n\nGo into the project folder and run\n\n```\nresolve-audit\n```\n\nIt goes through the results of `npm audit` and lets you decide what to do with the issues.\nThe decisions you make are stored in `audit-resolve.json` to keep track of it in version control and have a log of who decided to do what and when.\n\n### Arguments \n\n```\n--yarn switches to yarn instead of npm.\n--yarn-berry switches to yarn2 or yarn3 instead of npm.\n--migrate forces migration to the new audit-resolve.json file and format even if no modifications are made to decisions\n--mock used in tests\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n### Running in CI\n\nOne of the problems npm-audit-resolver solves is running audit as part of your build pipeline.\nYou don't want to break your CI for a few days waiting to get a fix on a dependency, but at the same time ignoring the whole class of issues or the audit result entirely means you'll rarely notice it at all.\n\nRun\n```\ncheck-audit\n```\n\nThis command will only exit with an error if a human needs to make new decisions about vulnerabilities and commit the `audit-resolve.json` file. If all issues are addressed, your build can pass.\n\nFor JSON output (similar to `npm audit --json`), run\n```\ncheck-audit --json\n```\n\nAll other arguments are passed down to the npm/yarn audit call\n\n## Features\n\nIf `npm audit fix` can help, you'll be prompted to run it first. \n\nFor all vulnerabilities found, you get to choose between the following options:\n\n- remind in 24h - Lets you ignore an issue temporarily to make the build pass until a fix is known\n- ignore - Adds the particular dependency paths and advisories to be ignored in the future. If the same issue in the same package comes up, but it's a dependency of another package, it won't get ignored. If a new issue is found in the package, it doesn't get ignored. You can decide if the decision expires or not.\n- delete - Removes your dependency that brought the vulnerability in its dependencies.\n- skip and quit, obviously\n\naudit-resolve.json is formatted, so git history has a trace of who addressed which vulnerability, when and how.\n\n### Why would I ignore security vulnerabilities?\n\nBecause otherwise running `npm audit` as part of your CI is not practical.\n\n- dev dependencies! a DOS vulnerability in your test runner's dependency is not a showstopper\n- build tooling vulnerability\n- dependencies of a tool you use very narrowly and can prove it's safe\n- new vulnerability without a fix and you want to wait for a fix while running your builds (there's a remind me in 24h option available)\n- Further in the future - because a maintainer you trust has checked and the vulnerability in their dependency tree that you pulled is not affecting the package you're using\n","readmeFilename":"README.md","homepage":"https://github.com/naugtur/npm-audit-resolver#readme","repository":{"type":"git","url":"git+https://github.com/naugtur/npm-audit-resolver.git"},"bugs":{"url":"https://github.com/naugtur/npm-audit-resolver/issues"}}