fix(npm): use —no-audit

lib/manager/npm/post-update/lerna.js

@@ -28,7 +28,7 @@ async function generateLockFiles(lernaClient, tmpDir, env) {
     logger.debug('Using lerna version ' + lernaVersion);
     const params =
       lernaClient === 'npm'
-        ? '--package-lock-only'
+        ? '--package-lock-only --no-audit'
         : '--ignore-scripts --ignore-engines --ignore-platform --mutex network:31879';
     cmd = `find . && ${lernaClient} install ${params} && npx lerna@${lernaVersion} bootstrap -- ${params}`;
     logger.debug({ cmd });

lib/manager/npm/post-update/npm.js

@@ -53,7 +53,7 @@ async function generateLockFile(tmpDir, env, filename) {
       }
     }
     logger.debug(`Using npm: ${cmd}`);
-    cmd = `find . && ${cmd} --version && ${cmd} install --package-lock-only && find .`;
+    cmd = `find . && ${cmd} --version && ${cmd} install --package-lock-only --no-audit && find .`;
     // TODO: Switch to native util.promisify once using only node 8
     ({ stdout, stderr } = await exec(cmd, {
       cwd: tmpDir,