Repository navigation
Expand file tree
/
Copy pathosv-scanner.toml
More file actions
49 lines (47 loc) · 3.54 KB
/
Copy pathosv-scanner.toml
File metadata and controls
49 lines (47 loc) · 3.54 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
# OSV-Scanner configuration for DOMPurify
#
# Scope: suppresses advisories present in package-lock that come from
# development / test / CI tooling, not the shipped DOMPurify runtime artifact.
# DOMPurify declares no runtime dependencies at all, so nothing suppressed
# here can reach a consumer of the published package.
#
# ignoreUntil is set to a one-year horizon so suppressions get re-evaluated
# annually instead of indefinitely. When updating, check whether the
# underlying dev dep has been replaced or upgraded out of the vulnerable
# range; if so, drop the entry instead of extending it.
#
# 2026-06: all prior IgnoredVulns dropped after the dev-tooling upgrades.
# - braces / micromatch / picomatch / semver: the xo 0.54 bundled set,
# cleared by upgrading xo to 0.60 (now 3.0.3 / 4.0.8 / 2.3.2+4.0.4 / >=7.5.2).
# - GHSA-f886-m6hf-6m8v, GHSA-jxxr-4gwj-5jf2 (brace-expansion): tree resolves
# to 1.1.15 / 2.1.1 / 5.0.6, all outside the vulnerable ranges.
# - GHSA-7mvr-c777-76hp (Playwright): fixed in 1.55.1; root tree is on 1.61.0.
# The legacy-browser harness pins 1.30-1.50.1 on purpose and keeps its own
# suppression at test/legacy-playwright/osv-scanner.toml.
#
# 2026-10: the two 2026-07 stopgaps (GHSA-3jxr-9vmj-r5cp brace-expansion,
# GHSA-52cp-r559-cp3m js-yaml) dropped: the lockfile refresh landed and the
# tree now resolves to brace-expansion 1.1.21 / 2.1.7 / 5.0.12 and js-yaml
# 4.3.2, all past the published fixes (1.1.16 / 2.1.2 / 5.0.7 and 4.3.0).
#
# GHSA-mh99-v99m-4gvg is NOT cleared by a refresh: its only fix is on the
# 5.x line (5.0.8). The top-level brace-expansion is on 5.0.12 and clears,
# but the transitive 1.x / 2.x copies pulled in by eslint / typescript-estree
# / test-exclude top out at 1.1.21 / 2.1.7 - both below 5.0.8, with no
# in-line backport - so they stay flagged until those parents adopt
# brace-expansion 5.x (or the copies are deduped out). Drop this entry then,
# not on a version bump of the dep alone.
#
# GHSA-vfj7-8cjw-p6xm (braces) has NO fix at all as of 2026-10-05: the
# advisory marks 3.0.3 as last_affected, 3.0.3 is the newest release on
# npm (2024-05), and micromatch 4.0.8 / xo 5.x still depend on ^3.0.3, so
# there is no parent upgrade that routes around it either. Drop this entry
# once a fixed braces ships and the lockfile picks it up.
[[IgnoredVulns]]
id = "GHSA-mh99-v99m-4gvg"
ignoreUntil = 2027-07-22
reason = "brace-expansion (CVE-2026-14257): unbounded expansion length causing an out-of-memory process crash, availability-only (CVSS 7.5). OSV range is [0, 5.0.8) with the fix on the 5.x line only. Dev-only path - the top-level copy is on 5.0.12 and clears, but the transitive 1.1.21 / 2.1.7 copies (eslint / typescript-estree / test-exclude) have no in-line backport and stay below 5.0.8 until those parents adopt brace-expansion 5.x. DOMPurify ships no runtime dependencies, so this is absent from the published artifact, and CI only ever expands repo-owned glob patterns, never attacker-controlled input."
[[IgnoredVulns]]
id = "GHSA-vfj7-8cjw-p6xm"
ignoreUntil = 2027-10-05
reason = "braces (CVE-2026-93687): stack exhaustion via deeply nested brace patterns in the recursive AST walkers, availability-only (CVSS 7.5). No fixed version exists: 3.0.3 is both last_affected and the newest npm release, and micromatch ^4.0.8 / xo pin ^3.0.3. Dev-only path - reached only via xo -> micromatch -> braces for lint-time glob matching of repo-owned patterns, never attacker-controlled input. DOMPurify ships no runtime dependencies, so this is absent from the published artifact."