Skip to content

chore: allowlist GHSA-ggr8-5vv4-36mx (deepmerge-ts) in audit gate #19

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Vlad G (vladpm) wants to merge 1 commit into
base: main
Choose a base branch
from
Open

chore: allowlist GHSA-ggr8-5vv4-36mx (deepmerge-ts) in audit gate #19

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions scripts/audit-with-allowlist.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,15 @@ const ALLOWED_ADVISORIES = new Map([
"postcss 8.x requires nanoid 3.x, but the advisory fix range is <3.3.18 which has not been published. postcss does not call nanoid with custom generators (size !== 0), so this app is not exploitable. Remove this allowlist entry once nanoid@3.3.18+ ships or postcss adopts nanoid@5.",
},
],
[
"GHSA-ggr8-5vv4-36mx",
{
package: "deepmerge-ts",
severity: "high",
reason:
"Transitive via prisma / @prisma/config, used only to merge developer-authored Prisma config at CLI/build time — not reachable with untrusted runtime input, so the prototype-pollution vector is not exploitable in this app. npm audit reports no non-breaking fix (fixAvailable is a semver-major prisma change). Remove once prisma ships a patched deepmerge-ts.",
},
],
]);

const argv = process.argv.slice(2);
Expand Down