Description

Bevan Rudge (BevanR)

opened on Jul 26, 2023

Issue body actions

To adopt socket npm in our team we'd need a way for it to remember which risks we've previously accepted, and only surface new ones. This feature doesn't appear to be supported yet.

Reacted by Thomas B., Joshua Barnes and Felix Ranesberger

Activity

1. John-David Dalton (jdalton)

   added

   enhancementNew feature or requestNew feature or request

   on Oct 11, 2024
2. felixranesberger commented on Nov 10, 2025

   

   Felix Ranesberger (felixranesberger)

   on Nov 10, 2025

   More actions

   Hey, we have a similar issue at our company. Is there some way to implement this?
   Thanks for any feedback!
3. jdalton commented on Aug 5, 2026

   

   John-David Dalton (jdalton)

   on Aug 5, 2026

   Contributor

   More actions

   Still not supported, and worth being clear about what exists today: socket.yml issueRules can turn a whole alert type on or off for a repo, but there is nothing that records "we looked at this specific package and version and accepted it" so later runs only surface what is new. That per-package acceptance, with the accepted set committed alongside the project so a team shares it, is the missing piece. It is a design question rather than a small patch — where the accepted set lives, whether an acceptance is pinned to an exact version or a range, and what expires it — so I'm writing up a scoped proposal rather than leaving this silent.

Issue actions