After fixing the issue in our audit-deps script, it becomes clear that there are two advisory that are triggering all the audit failures, in particular the semver one is the one that is hit by most of them as a transitive dependency (and based on a quick look not all the dependencies have been updated to fix their semver npm dependency):

diff --git a/.nsprc b/.nsprc
index 70c3aa7..8641594 100644
--- a/.nsprc
+++ b/.nsprc
@@ -1,6 +1,12 @@
 {
   "exceptions": [
     // See: https://github.com/mozilla/web-ext/issues/2678
-    "https://github.com/advisories/GHSA-p8p7-x288-28g6"
+    "https://github.com/advisories/GHSA-p8p7-x288-28g6",
+
+    // semver advisory
+    "https://github.com/advisories/GHSA-c2qf-rxjj-qqgw",
+
+    // word-wrap advisory
+    "https://github.com/advisories/GHSA-j8xg-fqg3-53r7"
   ]
 }

@willdurand Before considering adding these two to our nsprc and file bugs to remove the exceptions, I think that we may want to consider merging the dependabot PRs that are hitting only the audit-deps failure and then double-check how many other dependency are still make us hit the npm audit-deps because of this two advisories (and if any of them is actually part of runtime dependency which would also be hit by users of the web-ext package).

wdyt?

@willdurand Before considering adding these two to our nsprc and file bugs to remove the exceptions, I think that we may want to consider merging the dependabot PRs that are hitting only the audit-deps failure and then double-check how many other dependency are still make us hit the npm audit-deps because of this two advisories (and if any of them is actually part of runtime dependency which would also be hit by users of the web-ext package).

+1