[BUG] npm audit JSON output is not deterministic/stable

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

npm audit --json produces different results in each of several consecutive runs on the same input file.

The differences are mainly in the fixAvailable, effects and sometimes the via fields of the vulnerabilities key.

Expected Behavior

When running npm audit several times with the same package.json and package-lock.json I would only expect changes to the output if some new vulnerability is reported, details are added to one or a new fixed version is released.

This makes it hard to e.g. create or update issue tracker tickets based on the output since it leads to spurious updates.

Steps To Reproduce

On Linux
Internal project's npm config but

• "via" seems to change with cssnano <=4.1.11, usually a single postcss-* value is removed and one is added
• fixAvailable seems to sometimes just return true and sometimes css-loader 6.6.0 and sometimes switch between karma 6.3.13 and protractor 7.0.0 or remap-istanbul 0.13.0 and protractor 7.0.0 or webpack-dev-server 4.7.4 and karma 6.3.13
• effects seems to be sometimes empty and sometimes contain "cssnano"

The call is just

npm audit --json

Environment

• npm: 8.1.2
• Node.js: 16.13.1
• OS Name: Gentoo Linux
• System Model Name: AMD Ryzen 9 3900X 12 Core, 64GB RAM
• npm config: irrelevant, just shows node binary location and my pwd and HOME

Start by reproducing npm audit --json repeatedly with the same package.json and package-lock.json, comparing the via, fixAvailable, and effects fields described in the report. Done means identical output across consecutive runs unless vulnerability data or fixed-version details have changed.