mirror of
https://github.com/garrytan/gstack.git
synced 2026-11-05 00:03:15 +01:00
Garry Tanandcapy-ai[bot]
9dea818e34
* fix(deps): clear the OSV suppressions that expire on 2026-11-30 Delete the hono, @anthropic-ai/sdk (#2754) and sprintf-js ignores, which the lockfiles no longer match. Override image-size to 2.0.4 (#2753) and chokidar to 4.0.3 in lib/diagram-render (drops braces), and delete those ignores. Re-date katex to 2027-01-31: its fix is outside mermaid 11's range (mermaid-js/mermaid#8388). html-to-docx 1.8.0 bundles its own image-size 1.x, which the override cannot reach and whose ICNS parser loops forever. make-pdf --to docx now hands it only PNG, JPEG, GIF, WebP or SVG bytes. A golden docx test proves the Word output is unchanged. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * build(deps-dev): @types/bun 1.4.3, prettier 3.9.10; hold the Anthropic SDKs to patches Replaces dependabot #3228 without its agent-sdk 0.3 and sdk 0.133 bumps, which break typecheck:test and overlay-sdk-cancel-eof. Their 0.x breaking releases are semver-minor to dependabot, so the ignore covers minor and major. @types/bun 1.4.3 retires 18 test type diagnostics; the baseline locks that in. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(ci): exempt dependabot dependency-manifest PRs from Version Gate rule 1 Dependabot never edits VERSION, so hard rule 1 failed every package.json PR it opened. The workflow now passes the PR author and changed-file list; the gate skips rule 1 only for dependabot[bot] when every file is a package.json, bun.lock(b) or .github/dependabot.yml. A failed file lookup keeps the rule. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * fix(make-pdf): guard every html-to-docx sizing path, keep non-ICNS formats Review found three spellings that got past the regex guard and still hung --to docx: a data-src decoy, a percent-encoded separator, and an unquoted encoded colon. html-to-docx sizes images on three paths, and buildImage URI-decodes the whole src first. The guard now mirrors all three, drops ICNS (the only input its bundled image-size routes to the looping parser) instead of allowlisting formats, so BMP and TIFF embed as before, and re-parses the result with html-to-docx's own html-to-vdom to fail closed on anything the regex misreads. The golden test tolerates CRLF checkouts on Windows. Version Gate treats a failed file lookup as an empty list, so a partial paginated result cannot decide the exemption. Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore(release): stamp v1.91.121.0 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> * chore(release): restamp v1.91.122.0 Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com> --------- Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>
32 lines
1.9 KiB
TOML
32 lines
1.9 KiB
TOML
# OSV-Scanner configuration.
|
|
# Direct/transitive dependency versions are pinned to their fixed releases via
|
|
# the `overrides` block in package.json; this file only records advisories we
|
|
# have assessed as not-reachable or not-fixable without disproportionate risk.
|
|
#
|
|
# LOADING CONTRACT: OSV-Scanner only auto-discovers configs named
|
|
# osv-scanner.toml (no leading dot) and applies them per-directory — a root
|
|
# config never covers lib/diagram-render/bun.lock. The workflow therefore
|
|
# passes an explicit global `--config=.osv-scanner.toml`; the wiring test
|
|
# (test/osv-config-wiring.test.ts) pins that flag to this filename so the
|
|
# suppression file can never silently go inert again (it was inert from
|
|
# v1.65.0.0 to v1.78.0.0).
|
|
#
|
|
# Every entry carries `ignoreUntil` — suppressions expire and must be
|
|
# re-justified; the re-scan on expiry either finds a fix landed upstream or
|
|
# forces a fresh decision. Tracking issues are filed at ship time and named in
|
|
# each reason.
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-238p-pmpm-9mq7"
|
|
# katex 0.16.47 in lib/diagram-render (mermaid's math renderer). The advisory
|
|
# needs prototype pollution to already exist in the page; the render page is
|
|
# offline, loads only gstack's own bundle and the user's diagram source. Low
|
|
# severity (2.1). The fix is katex 0.18.2, outside mermaid 11's ^0.16.47 range.
|
|
# Mermaid 12 accepts ^0.18, but @excalidraw/mermaid-to-excalidraw 2.2.2 (the
|
|
# latest) requires mermaid ^11.12.1, and katex 0.18 renames KaTeX's CSS
|
|
# classes, so forcing it means a bundle requalification, not a lockfile bump.
|
|
# Upgrade trigger: a mermaid 11.x release that allows katex 0.18
|
|
# (https://github.com/mermaid-js/mermaid/issues/8388), then rebuild the bundle.
|
|
reason = "Fix (katex 0.18.2) is outside mermaid 11's ^0.16 range; waiting on mermaid-js/mermaid#8388. Needs pre-existing prototype pollution in an offline single-bundle page; low severity."
|
|
ignoreUntil = 2027-01-31T00:00:00Z
|