mirror of
https://github.com/garrytan/gstack.git
synced 2026-09-21 20:30:47 +02:00
SinabinaandClaude Opus 4.8
d240b0fa6a
New advisories landed after the integration work: fast-uri (High) and hono (3x Medium) picked up fixed releases, and a Medium surfaced on @hono/node-server. Bump the fast-uri and hono override pins to their fixed patch releases (3.1.3, 4.12.27), clearing four findings. The remaining @hono/node-server advisory is reachable only through the unused @modelcontextprotocol/sdk transitive (no source imports it, no Hono server is started); its only fix is a major bump the SDK pins against. Record that assessment in .osv-scanner.toml so the scheduled scan stays honest instead of alarming on an unreachable path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
16 lines
941 B
TOML
16 lines
941 B
TOML
# OSV-Scanner configuration.
|
|
# Direct/transitive dependency versions are pinned to their fixed releases via
|
|
# the `overrides` block in package.json; this file only records advisories we
|
|
# have assessed as not-reachable or not-fixable without disproportionate risk.
|
|
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-frvp-7c67-39w9"
|
|
# @hono/node-server 1.19.x. Reachable only through @modelcontextprotocol/sdk,
|
|
# which is an unused transitive dependency (no source file imports it) and never
|
|
# starts a Hono HTTP server, so the advisory's request path is not exercised.
|
|
# The only fix is @hono/node-server 2.0.5, a major bump the MCP SDK pins against
|
|
# (^1.19.9); forcing it via override risks breaking the SDK at runtime for a
|
|
# vulnerability we do not expose. Re-evaluate if the MCP SDK becomes a direct,
|
|
# server-hosting dependency.
|
|
reason = "Unreachable transitive (unused @modelcontextprotocol/sdk); fix requires a risky major override on a pinned peer dep."
|