[ernolf]

• add NO_ADVISORIES=1 and --no-advisories to deps-audit, which leave the vulnerabilities out of the report, the JSON and build/deps-audit
• keep only the abandoned packages of composer audit in that mode, and clear the exit code bit that says an advisory was found
• skip npm audit in that mode, since it reports no abandoned packages
• replace the [ok] finding deps-audit with the same [i] advisories-unchecked for every app, and mark the JSON with "advisories": false

---

Closes #373

A run whose output is public can now take the abandoned packages and the licences from deps-audit without showing a vulnerability. Make hands NO_ADVISORIES=1 to both halves as DEPS_AUDIT_NO_ADVISORIES. --no-advisories in ARGS counts the same, so the composer half also leaves the advisories out when only the analyser option is given. In lib/deps-audit.php the output of composer audit keeps only abandoned. why-not and show do not run, and bit 1 of the exit code is cleared, so build/deps-audit/composer.json holds nothing about an advisory. The analyser ignores advisories in a composer.json that an earlier run left there, and it does not run the npm audit.

The [ok] finding deps-audit would mark every app without a vulnerable package, so in this mode it is replaced by advisories-unchecked, which is the same for every app. A composer audit that does not answer still gives audit-unavailable, now worded for the abandoned packages. The summary line of the report and its closing text say that the advisories were not checked. The help, the make help line and the skill describe the option.

Tested on a fixture with a composer.lock, a build/deps-audit/composer.json holding one advisory and one abandoned package, and a package-lock.json. With --no-advisories and with DEPS_AUDIT_NO_ADVISORIES=1, the report and the JSON name no advisory, CVE or vulnerable package. The fixture still gives licence-incompatible, abandoned-dependency, licence-summary and advisories-unchecked, and the JSON has "advisories": false. Without the option the same fixture reports vulnerable-dependency as before. lib/deps-audit.php was run on PHP 8.4 against a composer stub that reports an advisory and an abandoned package. With DEPS_AUDIT_NO_ADVISORIES=1 its output holds only abandoned, exit code 2 and no fixes. Without it, the output is unchanged.