audit-ci.json

{
	"low": true,
	"skip-dev": true,
	"allowlist": [
		"GHSA-xvch-5gv4-984h", // Not used at runtime
		"GHSA-93q8-gq69-wqmw", // Not used at runtime
		"GHSA-pfrx-2q88-qq97", // Not used at runtime
		"GHSA-xvf7-4v9q-58w6", // Not used at runtime
		"GHSA-9pgh-qqpf-7wqj", // Not used at runtime
		"GHSA-f8q6-p94x-37v3", // Not used at runtime
		"GHSA-hrpp-h998-j3pp", // Not used at runtime because this deals with lighthouse, a website performance test library, and this is only used in dev ci
		"GHSA-w573-4hg7-7wgq", // Not used at runtime because this is only used in dev ci
		"GHSA-76p3-8jx3-jpfq", // Not used at runtime because this is only used in dev ci
		"GHSA-3rfm-jhwj-7488", // Not used at runtime because this is only used in dev ci
		"GHSA-hjrf-2m68-5959", // Not used at runtime because this is only used in dev ci
		"GHSA-prr3-c3m5-p7q2", // Not used at runtime
		"GHSA-67hx-6x53-jw92", // Not used at runtime
		"GHSA-hhhv-q57g-882q", // Not used at runtime
		"GHSA-ghr5-ch3p-vcr6", // Not used at runtime because this is only used via a rollup plugin
		"GHSA-rv95-896h-c2vc", // Not used at runtime because this is only used via @lhci/cli
		"GHSA-fr5h-rqp8-mj6g", // Does not apply to Vercel-hosted applications
		"GHSA-grv7-fg5c-xmjg", // Not used at runtime
		"GHSA-3h5v-q93c-6h6q", // Not used at runtime and is related to @lhci/cli
		"GHSA-952p-6rrq-rcjv", // Not used at runtime
		"GHSA-9wv6-86v2-598j", // Used by lighthouse CI, not at runtime
		"GHSA-qwcr-r2fm-qrc7", // Used by lighthouse CI, not at runtime
		"GHSA-qw6h-vgh9-j6wx", // Used by lighthouse CI, not at runtime
		"GHSA-m6fv-jmcg-4jfg", // Used by lighthouse CI, not at runtime
		"GHSA-m6fv-jmcg-4jfg", // Used by lighthouse CI, not at runtime
		"GHSA-cm22-4g7w-348p", // Used by lighthouse CI, not at runtime
		"GHSA-gp8f-8m3g-qvj9", // Deployments on Vercel are not affected
		"GHSA-c2qf-rxjj-qqgw", // Not used at runtime
		"GHSA-pxg6-pf52-xh8x|@lhci/cli>*", // Used by lighthouse CI, not at runtime
		"GHSA-pxg6-pf52-xh8x|@lhci/utils>*", // Used by lighthouse CI, not at runtime
		"GHSA-pxg6-pf52-xh8x|express>cookie", // Used by lighthouse CI, not at runtime
		"GHSA-3xgq-45jj-v275", // cross-spawn is used by @next/eslint-plugin-next,  audit-ci, cross-env, eslint, and jest. It is not used at runtime
		"GHSA-7gfc-8cq8-jh5f", // If your Next.js application is hosted on Vercel, this vulnerability has been automatically mitigated, regardless of Next.js version
		"GHSA-mwcw-c2x4-8c55" // Not used at runtime
	]
}