-
Notifications
You must be signed in to change notification settings - Fork 3
Expand file tree
/
Copy pathosv-scanner.toml
More file actions
87 lines (76 loc) · 5.18 KB
/
Copy pathosv-scanner.toml
File metadata and controls
87 lines (76 loc) · 5.18 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
# osv-scanner accepted-risk allowlist.
#
# Each entry must include reasoning + a re-evaluation date. Re-run
# `osv-scanner --lockfile=bun.lock` periodically to confirm each remains
# accepted-risk. bun.lock is canonical.
# esbuild advisories reach us only transitively through Vite / Astro / Wrangler,
# which are BUILD-TIME dev dependencies for the docs site and the web-scaffold
# build. esbuild is not in the published @agjs/tsforge npm package (files: bin,
# src, *.eslint.config.mjs) — there is no runtime or published-artifact exposure.
# Re-evaluate once Vite/Astro ship a patched esbuild range.
[[IgnoredVulns]]
id = "GHSA-gv7w-rqvm-qjhr"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "esbuild (transitive via Vite/Astro/Wrangler) is a build-time dev dependency only; not shipped in the published package."
[[IgnoredVulns]]
id = "GHSA-g7r4-m6w7-qqqr"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "esbuild (transitive via Vite/Astro/Wrangler) is a build-time dev dependency only; not shipped in the published package."
# dompurify reaches us only through mermaid in the @tsforge/docs site workspace —
# a build-time/docs dev dependency, not in the published @agjs/tsforge package.
[[IgnoredVulns]]
id = "GHSA-cmwh-pvxp-8882"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "dompurify (transitive via mermaid in the docs-site workspace) is a build-time/docs dev dependency only; not shipped in the published package. Re-evaluate when mermaid ships a patched dompurify range."
# SUPERSEDED 2026-08-03: undici is now pinned to ^7.29.0 in package.json
# `overrides`, so none of the entries below match anything in bun.lock. They are
# kept only until the next allowlist review (ignoreUntil below).
#
# The original rationale — "the published package's undici (via jsdom) is already
# 7.28.0, i.e. patched" — EXPIRED: five advisories published against 7.28.0 itself
# (GHSA-4cwx-7wf7-3272, GHSA-8xcm-r25x-g524, GHSA-jr45-8vmc-qm54,
# GHSA-m8rv-5g2x-5cg5, GHSA-v3r7-h72x-cjcm) made the runtime copy vulnerable too,
# which is exactly the exposure the accepted risk assumed did not exist. Bumped
# rather than allowlisted, because it reaches the published package.
[[IgnoredVulns]]
id = "CVE-2026-9678"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "undici 7.24.8 reaches us only via wrangler→miniflare (docs-deploy dev dependency); the published package's undici (via jsdom) is already 7.28.0 (patched). Re-evaluate when wrangler/miniflare bump undici."
[[IgnoredVulns]]
id = "CVE-2026-9697"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "undici 7.24.8 (SOCKS5 ProxyAgent TLS-validation bypass) reaches us only via wrangler→miniflare (docs-deploy dev dependency), not the tsforge runtime; the published package's undici (via jsdom) is already 7.28.0 (patched). Re-evaluate when wrangler/miniflare bump undici."
# Five further undici advisories published 2026-06-19, all against the SAME
# dev-only undici@7.24.8 (verified: bun.lock pins it ONLY at miniflare/undici;
# the runtime undici via jsdom is 7.28.0 and is NOT flagged). Same accepted-risk
# rationale as the two CVEs above — not in the published @agjs/tsforge package.
[[IgnoredVulns]]
id = "GHSA-35p6-xmwp-9g52"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "undici 7.24.8 (miniflare→wrangler dev dependency only); runtime undici (via jsdom) is 7.28.0/unaffected; not shipped in the published package. Re-evaluate when wrangler/miniflare bump undici."
[[IgnoredVulns]]
id = "GHSA-g8m3-5g58-fq7m"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "undici 7.24.8 (miniflare→wrangler dev dependency only); runtime undici (via jsdom) is 7.28.0/unaffected; not shipped in the published package. Re-evaluate when wrangler/miniflare bump undici."
[[IgnoredVulns]]
id = "GHSA-hm92-r4w5-c3mj"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "undici 7.24.8 (miniflare→wrangler dev dependency only); runtime undici (via jsdom) is 7.28.0/unaffected; not shipped in the published package. Re-evaluate when wrangler/miniflare bump undici."
[[IgnoredVulns]]
id = "GHSA-p88m-4jfj-68fv"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "undici 7.24.8 (miniflare→wrangler dev dependency only); runtime undici (via jsdom) is 7.28.0/unaffected; not shipped in the published package. Re-evaluate when wrangler/miniflare bump undici."
[[IgnoredVulns]]
id = "GHSA-vxpw-j846-p89q"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "undici 7.24.8 (miniflare→wrangler dev dependency only); runtime undici (via jsdom) is 7.28.0/unaffected; not shipped in the published package. Re-evaluate when wrangler/miniflare bump undici."
# valibot 1.4.1 reaches us ONLY transitively via eslint-plugin-better-tailwindcss
# (dependencies.valibot ^1.3.1) — a build-time ESLint plugin dev dependency. It is
# NOT in the published @agjs/tsforge package (files: bin, src, *.eslint.config.mjs),
# so there is no runtime or published-artifact exposure. Advisory published
# 2026-07-24 (Medium 6.9). Re-evaluate when eslint-plugin-better-tailwindcss bumps
# its valibot range to >=1.4.2 (the patched version).
[[IgnoredVulns]]
id = "GHSA-5qjj-4xww-7phc"
ignoreUntil = 2026-09-12T00:00:00Z
reason = "valibot 1.4.1 (transitive via eslint-plugin-better-tailwindcss, a dev-only ESLint plugin); not shipped in the published package. Re-evaluate when the plugin bumps valibot to >=1.4.2."