How to ignore a package during npm audit? - npm

Question

My npm audit report shows handsontable as "no fix available".
I am trying to ignore the handsontable package by running npm audit --ignore handsontable or npm audit --ignore=handsontable
It is not ignoring the package.
Is there any flag to ignore certain packages during npm audit and npm audit fix

Answer 1

As of today, 21 Sept 2022, npm audit has 2 ways to filter vulnerabilities:
audit-level - sets the minimum level of vulnerability for npm audit to exit with a non-zero exit code.
omit - selects dependency types (dev/prod) to omit from the installation tree on disk.
You can see more about npm audit flags here.
There is no way to ignore specific vulnerabilities yet. I believe npm will have it soon, the discussion is still ongoing.
I recommend you to use the npm package better-npm-audit. Link here.
You can create a file .nsprc and ignore vulnerabilities by ID, CWE ID or GHSA ID as shown below:
{
"1337": {
"active": true,
"notes": "Ignored since we don't use xxx method",
"expiry": 1615462134681
},
"4501": {
"active": false,
"notes": "Ignored since we don't use xxx method"
},
"CWE-471": "CWE ID is acceptable",
"GHSA-ww39-953v-wcq6": "GHSA ID is acceptable",
"https://npmjs.com/advisories/1213": "Full or partial URL is acceptable too"
}