mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-11 23:49:01 +02:00
57 lines
3.1 KiB
TOML
57 lines
3.1 KiB
TOML
# OSV-Scanner configuration.
|
|
# Direct/transitive dependency versions are pinned to their fixed releases via
|
|
# the `overrides` block in package.json; this file only records advisories we
|
|
# have assessed as not-reachable or not-fixable without disproportionate risk.
|
|
#
|
|
# LOADING CONTRACT: OSV-Scanner only auto-discovers configs named
|
|
# osv-scanner.toml (no leading dot) and applies them per-directory — a root
|
|
# config never covers lib/diagram-render/bun.lock. The workflow therefore
|
|
# passes an explicit global `--config=.osv-scanner.toml`; the wiring test
|
|
# (test/osv-config-wiring.test.ts) pins that flag to this filename so the
|
|
# suppression file can never silently go inert again (it was inert from
|
|
# v1.65.0.0 to v1.78.0.0).
|
|
#
|
|
# Every entry carries `ignoreUntil` — suppressions expire and must be
|
|
# re-justified; the re-scan on expiry either finds a fix landed upstream or
|
|
# forces a fresh decision. Tracking issues are filed at ship time and named in
|
|
# each reason.
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-frvp-7c67-39w9"
|
|
# @hono/node-server 1.19.x. Reachable only through @modelcontextprotocol/sdk,
|
|
# which is an unused transitive dependency (no source file imports it) and never
|
|
# starts a Hono HTTP server, so the advisory's request path is not exercised.
|
|
# The only fix is @hono/node-server 2.0.5, a major bump the MCP SDK pins against
|
|
# (^1.19.9); forcing it via override risks breaking the SDK at runtime for a
|
|
# vulnerability we do not expose. Re-evaluate if the MCP SDK becomes a direct,
|
|
# server-hosting dependency.
|
|
reason = "Unreachable transitive (unused @modelcontextprotocol/sdk); fix requires a risky major override on a pinned peer dep."
|
|
ignoreUntil = 2026-11-30T00:00:00Z
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-5p2g-fcmc-qvqq"
|
|
# image-size 1.2.1 via html-to-docx@1.8.0 (pins ^1.0.0). No fixed release
|
|
# exists (FIXED VERSION = --; tracking: #2753). Exposure: image-size only parses images the
|
|
# user themselves embeds into their own generated .docx — no untrusted input
|
|
# path. Upgrade trigger: an image-size release with a fix, or html-to-docx
|
|
# moving off it. Tracking: #2753.
|
|
reason = "No fixed version exists; local-only input path (user's own docx images). Re-evaluate on expiry."
|
|
ignoreUntil = 2026-11-30T00:00:00Z
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-w3rx-r6r6-pgpr"
|
|
# Same package/node as GHSA-5p2g-fcmc-qvqq above; same rationale.
|
|
reason = "No fixed version exists; local-only input path (user's own docx images). Re-evaluate on expiry."
|
|
ignoreUntil = 2026-11-30T00:00:00Z
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-p7fg-763f-g4gf"
|
|
# @anthropic-ai/sdk 0.81.0 nested under @anthropic-ai/claude-agent-sdk@0.2.117,
|
|
# which is deliberately exact-pinned (eval-harness stability; the v1.77 wave
|
|
# pinned the whole harness after repeated CLI-drift breakage) and declares
|
|
# ^0.81.0 (0.x caret = 0.81.x only), so the 0.91.1 fix cannot be reached
|
|
# without violating the harness pin. 4.8 MEDIUM. Upgrade trigger: the next
|
|
# deliberate claude-agent-sdk bump. Tracking: #2754.
|
|
reason = "Fix requires breaking the deliberate eval-harness agent-sdk pin; MEDIUM severity accepted until the next harness bump."
|
|
ignoreUntil = 2026-11-30T00:00:00Z
|