disabled: false

ignore:
  # The CI grype job fails on any Critical, High or Medium match, so the one entry below is
  # required. braces has no patched release in any major (<= 3.0.3 affected, 3.0.3 is the
  # newest published) and one of its paths, ts-auto-mock -> micromatch, is already at
  # latest. Mirrors the audit-ci.jsonc allowlist. Remove when braces 3.0.4 ships.
  # Removed: sprintf-js (left the tree when argparse 1 was bumped to 2) and the two convict
  # advisories GHSA-44fc-8fm5-q62h / GHSA-hf2r-9gf9-rwch (convict 6.2.5 is installed, which
  # is the patched version).
  - vulnerability: GHSA-vfj7-8cjw-p6xm
    include-aliases: true
    reason: 'braces: no patched release exists (<= 3.0.3 affected, 3.0.3 is latest); ts-auto-mock -> micromatch path already at latest'

# Set output format defaults
output:
  - "table"
  - "json"

# Modify your CircleCI job to check critical count
search:
  scope: "squashed"
quiet: false
check-for-app-update: false