template-kit/audit-severity

A dependency with a high or critical advisory fails. Low and moderate pass, on purpose. There is no way to suppress it.

Rule

npm audit runs over your workspace, and a violation is reported for each advisory at severity high or critical.

Low and moderate advisories are a deliberate pass. They are not “not yet enforced” — they are not enforced. Nobody will ask you to clear them.

There is no suppression mechanism. No inline waiver, no ignore file, no severity override. If you are looking for the flag, there isn’t one, and that is the design.

Reason

The kit lets you reach for third-party packages — a carousel, a map SDK, a date formatter — because a section that has to hand-write everything is a section nobody finishes. The consequence is that your dependency tree ships to a published page we host for a customer, so the supply chain is part of the submission.

This gate is the floor, not a review. Cutting at high/critical is what keeps it a floor: a rule that fired on every transitive moderate would be a rule everyone learned to route around, and the exception would swallow the check. Two severities, no exceptions, and a clear answer to “can I ship this.”

Fix

In order of preference:

1. npm audit fix — resolves most advisories by moving a transitive dependency inside its existing range.
2. Upgrade the offending package. If the fix is in a new major, npm audit fix --force will take it, but read what it changes first.
3. Drop the package. An advisory with no fix available is a package with no fix available. Replace it, or hand-write the part of it you actually use.

Then re-run npm audit and commit the lockfile.

Before

$ npm audit
# npm audit report

marked  <4.0.10
Severity: high
Inefficient Regular Expression Complexity in marked
fix available via `npm audit fix --force`

1 high severity vulnerability

package.json

{
  "dependencies": {
    "marked": "^3.0.8"
  }
}

After

package.json

{
  "dependencies": {
    "marked": "^14.1.2"
  }
}

$ npm audit
found 0 vulnerabilities

See also

• license-denied — the other supply-chain gate on your production dependencies.
• lockfile-stale — commit the lockfile the fix regenerated.