From ae8999a2256a1c82d30b18ab70229f1015cb26e2 Mon Sep 17 00:00:00 2001 From: osv-scanner-prune-bot Date: Fri, 7 Aug 2026 12:14:27 +0000 Subject: [PATCH] chore(deps): remove GHSA-v2hh-gcrm-f6hx from osv-scanner.toml fast-uri upgraded to 3.1.5, vulnerability fixed in 3.1.4 Ticket: HSM-429 --- osv-scanner.toml | 4 ---- 1 file changed, 4 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index 175ea2402e..50d5917ba9 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -62,10 +62,6 @@ reason = "tar decompression/parse DoS via unlimited input; transitive via lerna/ id = "GHSA-8x88-c5mf-7j5w" reason = "tar infinite loop via negative entry size; transitive via lerna/yeoman-generator/swarm-js requiring tar <7.5.18; fix only in tar 7.5.18+ which breaks lerna packDirectory (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only, not extraction" -[[IgnoredVulns]] -id = "GHSA-v2hh-gcrm-f6hx" -reason = "fast-uri host confusion via literal backslash authority (CVE-2026-16221); fixed in 3.1.4 but that release is held for SafeChain. Pinning 3.1.3 clears GHSA-4c8g-83qw-93j6 / CVE-2026-13676. Re-evaluate on 2026-07-26: bump to 3.1.4 and remove this temporary exclusion (security team guidance, WCI-1125)" - [[IgnoredVulns]] id = "GHSA-jmr9-qjv8-65gv" reason = "extract-zip unvalidated symlink path traversal on extraction (CVE-2026-56876); transitive via cypress and @puppeteer/browsers, both dev-only tooling; extracted archives are Cypress/Chromium binary release downloads from trusted sources, never untrusted user-supplied zips; no upstream fix (last_affected: 2.0.1, which is the latest release). Re-evaluate on 2026-11-13: drop this exclusion if extract-zip ships a patched release"