Filtering out a few false positives is easier than auditing every dependency from scratch by yourself, and probably less effort than explaining to your users wh

Filtering out a few false positives is easier than auditing every dependency from scratch by yourself, and probably less effort than explaining to your users why your site didn't include a fix for a known vulnerability. I take your point about "npm audit" being an annoying tool to use, though, and would recommend the package better-npm-audit in its place, which allows developers to ignore specific vulnerabilities by adding entries to a config file that can be committed to the repo. https://www.npmjs.com/package/better-npm-audit https://www.npmjs.com/package/better-npm-audit