forked from segmentio/analytics-next
-
Notifications
You must be signed in to change notification settings - Fork 6
Expand file tree
/
Copy pathsocket.yml
More file actions
76 lines (72 loc) · 4.18 KB
/
Copy pathsocket.yml
File metadata and controls
76 lines (72 loc) · 4.18 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
# Socket.dev configuration — CDP-5745 supply-chain remediation
#
# Scope of this file: silence LOW-SIGNAL scanner *policy* flags on dev/build-time
# transitive packages that (a) have no CVE and no published fix, and (b) are not
# in any shipped bundle. Real supply-chain alert types stay ENABLED so the ~12
# shipped runtime deps still get flagged.
#
# See VULN_REMEDIATION_REMAINING.md §5 for the full rationale.
version: 2
issueRules:
# ---------------------------------------------------------------------------
# Globally silence the bulk of the noise: the ~98 `@stdlib/*` micro-packages
# (+ `trim`) that trip the "trivial package" heuristic. They are inherently
# low-signal (prerelease 0.0.x math/util shims), all transitive under the
# `@segment/tsub` browser devDep, and NOT in the UMD bundle (the SDK ships a
# vendored copy of tsub). Safe repo-wide.
trivialPackage: false
# ---------------------------------------------------------------------------
# Keep every REAL supply-chain alert type ON — these are the ones that matter
# for the shipped runtime dependencies.
installScripts: true
unmaintained: true
deprecated: true
unstableOwnership: true
newAuthor: true
malware: true
gptSecurity: true
gptMalware: true
telemetry: true
troll: true
didYouMean: true
# -----------------------------------------------------------------------------
# Per-package ignores (dev/build-time only, no CVE + no fix).
#
# Socket cannot allowlist individual packages via socket.yml, so apply these as
# a PR comment or via the Socket dashboard. All are transitive under DEV deps
# and absent from the shipped bundles.
#
# @SocketSecurity ignore segmentio-facade@3.2.7 # via @segment/analytics.js-integration-amplitude (dev)
# @SocketSecurity ignore @segment/facade@3.4.10 # dev
# @SocketSecurity ignore @segment/analytics.js-integration-amplitude@3.3.3
# @SocketSecurity ignore trim@1.0.0 # via amplitude integration
# @SocketSecurity ignore csp_evaluator@1.1.0 # via lighthouse (dev)
# @SocketSecurity ignore date-fns@2.29.3 # via concurrently (dev)
# @SocketSecurity ignore breakword@1.0.5 # via csv tooling (dev)
# @SocketSecurity ignore diff-sequences@27.5.1 # via jest (dev)
# @SocketSecurity ignore diff-sequences@28.1.1 # via jest (dev)
# @SocketSecurity ignore kind-of@6.0.3 # via build tooling (dev)
# @SocketSecurity ignore object.assign@4.1.2 # via build tooling (dev)
# @SocketSecurity ignore uri-js@4.4.1 # via ajv (dev)
# @SocketSecurity ignore intl-messageformat-parser@1.8.1 # dev
# @SocketSecurity ignore caniuse-lite@1.0.30001805 # via browserslist (dev)
# @SocketSecurity ignore @npmcli/move-file@2.0.0 # via node-gyp / cacache (dev)
# @SocketSecurity ignore npmlog@6.0.2 # via node-gyp (dev)
# @SocketSecurity ignore gauge@4.0.4 # via node-gyp (dev)
# @SocketSecurity ignore are-we-there-yet@3.0.0 # via node-gyp (dev)
# @SocketSecurity ignore buffer@5.7.1 # via build tooling (dev)
# @SocketSecurity ignore buffer@6.0.3 # via build tooling (dev)
# @SocketSecurity ignore jsdom@19.0.0 # via jest (dev)
# @SocketSecurity ignore cssom@0.3.8 # via jsdom (dev)
# @SocketSecurity ignore cssom@0.5.0 # via jsdom (dev)
# @SocketSecurity ignore whatwg-encoding@2.0.0 # via jsdom (dev)
# @SocketSecurity ignore @humanwhocodes/object-schema@1.2.1 # via eslint (dev)
# @SocketSecurity ignore esquery@1.4.0 # via eslint (dev)
# @SocketSecurity ignore webpack-cli@4.8.0 # dev build tooling
# @SocketSecurity ignore @playwright/test@1.61.1 # dev test tooling
# @SocketSecurity ignore typescript@4.9.5 # dev tooling
#
# NOTE: xmlbuilder / sax / querystring were dropped from this list — they left
# the tree when the unused aws-sdk v2 devDep was removed. Versions above are
# reconciled against the current yarn.lock; if Socket flags a different version,
# match the exact pkg@version it reports.