做`yarn / npm publish`时会忽略`nsp check`吗？

Question

I'm trying to publish a javascript package to an internal repository. When I do yarn publish (or npm publish ) it now runs nsp check (otherwise wonderful feature!) to look for known vulnerabilities in any of the dependencies in my project. It finds one and exits in error:

[3/4] Publishing...
$ nsp check
(+) 1 vulnerability found
...
│ More Info  │ https://nodesecurity.io/advisories/nnn                 |
...
error Command failed with exit code 1.
info Visit https://yarnpkg.com/en/docs/cli/publish for documentation about this command.

I'd like to ignore this vulnerability and proceed with the publish anyway. How can I do that?

I understand that introducing a way to ignore a vulnerability may be misused, but in this instance the package I'm publishing is an internal tool. I've looked at the dependency's vulnerability and in no way could it be taken advantage of in the context in which I'm using it.

Sidenote: The vulnerability is nested 3 layers deep in a pretty commonly used package ( request@2.87.0 ). The vulnerability itself has been fixed in its own latest version, but because this dependency is three layers deep we have to wait for each subsequent dependent to upgrade. I suspect it will take some time- there's been a ticket open in their Github for 3 months- and I don't want to wait on that.

Answer 1

I've found the answer to this:

Add a file called .nsprc at the top of your project. In the file add:

{
    "exceptions": ["https://nodesecurity.io/advisories/nnn"]
}

The URL should match the URL of the vulnerability presented in the nsp check command.