Audit yarn dependencies with allowlist

Makefile

@@ -83,7 +83,7 @@ endif
 	bundle exec bundler-audit check --update
 	# JavaScript
 	@echo "--- yarn audit ---"
-	yarn audit --groups dependencies; test $$? -le 7
+	make audit_yarn_packages
 	@echo "--- eslint ---"
 	yarn run lint
 	@echo "--- typescript ---"
@@ -104,6 +104,8 @@ endif
 	@echo "--- lint migrations ---"
 	make lint_migrations
 
+audit_yarn_packages:
+	npx -y audit-ci@6.6.1 --config ./audit-ci.jsonc
 
 lint_erb: ## Lints ERB files
 	bundle exec erblint app/views app/components

audit-ci.jsonc

@@ -0,0 +1,13 @@
+{
+  "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
+  "moderate": true,
+  "allowlist": [
+    {
+      "GHSA-c2qf-rxjj-qqgw": {
+        "active": true,
+        "notes": "semver RegExp DoS, pending upstream release, vulnerable path not applicable",
+        "expiry": "2023-09-01"
+      }
+    }
+  ]
+}