Skip to content

fix: Resolve security vulnerabilities and ignore unfixable transitive dep vulns #72

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anurag-stepsecurity wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: Resolve security vulnerabilities and ignore unfixable transitive dep vulns #72

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 19 additions & 0 deletions osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
[[IgnoredVulns]]
id = "GHSA-g9mf-h72j-4rw9"
reason = "undici - Low risk; requires malicious GitHub API response; action only calls trusted GitHub endpoints"

[[IgnoredVulns]]
id = "GHSA-2mjp-6q6p-2qxm"
reason = "undici - Low risk; requires proxy misconfiguration; action runs in GitHub-hosted environment"

[[IgnoredVulns]]
id = "GHSA-vrm6-8vpv-qv8q"
reason = "undici - Not exploitable; WebSocket functionality not used by this action"

[[IgnoredVulns]]
id = "GHSA-v9p9-hfj2-hcw8"
reason = "undici - Not exploitable; WebSocket functionality not used by this action"

[[IgnoredVulns]]
id = "GHSA-4992-7rv2-5pvq"
reason = "undici - Not exploitable; upgrade option not used by this action"
24 changes: 12 additions & 12 deletions reports/jest/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 8 additions & 0 deletions reports/mocha/osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,3 +9,11 @@ reason = "Test dependency"
[[IgnoredVulns]]
id = "GHSA-73rr-hh4g-fpgx"
reason = "Test dependency"

[[IgnoredVulns]]
id = "GHSA-5c6j-r48x-rmvq"
reason = "Test dependency - serialize-javascript transitive dep of mocha, unfixable (mocha 8-12 all depend on it)"

[[IgnoredVulns]]
id = "GHSA-qj8w-gfj5-8c6v"
reason = "Test dependency - serialize-javascript transitive dep of mocha, unfixable (mocha 8-12 all depend on it)"
44 changes: 28 additions & 16 deletions reports/mocha/package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

8 changes: 8 additions & 0 deletions reports/mochawesome/osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,3 +33,11 @@ reason = "Test dependency"
[[IgnoredVulns]]
id = "GHSA-6rw7-vpxm-498p"
reason = "Test dependency"

[[IgnoredVulns]]
id = "GHSA-5c6j-r48x-rmvq"
reason = "Test dependency - serialize-javascript transitive dep of mocha, unfixable (mocha 8-12 all depend on it)"

[[IgnoredVulns]]
id = "GHSA-qj8w-gfj5-8c6v"
reason = "Test dependency - serialize-javascript transitive dep of mocha, unfixable (mocha 8-12 all depend on it)"
Loading
Loading