diff options
| author | Leitwolf11 | 2026-10-03 13:45:34 +0300 |
|---|---|---|
| committer | Leitwolf11 | 2026-10-03 13:45:34 +0300 |
| commit | 7d89667081342ee39e41e1ad948a6a5bf3a31275 (patch) | |
| tree | 2826d4fa90b64f6787cbae7514e867d95b6a3a16 | |
| parent | 8ba8d26ec4e6e900275fd5cd94e37a7aac701a1f (diff) | |
| download | progmaweb-ci/audit-braces-exception.tar.gz | |
Accept the unfixable braces advisory in the dependency auditci/audit-braces-exception
The dependency audit fails on every branch since GHSA-vfj7-8cjw-p6xm was
published: braces <= 3.0.3 can exhaust the stack on deeply nested brace
patterns. There is no fixed release; 3.0.3 is the latest version, and the
latest fast-glob and micromatch still depend on it.
braces is reached only through the lint toolchain (eslint-config-next >
@next/eslint-plugin-next > fast-glob > micromatch). It is not part of the
built or deployed application, and it only receives the glob patterns of
this repository.
The audit now ignores this one advisory by its identifier. Every other
advisory of high severity still fails the check, and the entry carries the
reason and the condition for removing it.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
| -rw-r--r-- | pnpm-workspace.yaml | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml index 68deb25..7b3dd1b 100644 --- a/pnpm-workspace.yaml +++ b/pnpm-workspace.yaml @@ -12,3 +12,13 @@ overrides: # published denial-of-service advisories fixed by 5.0.12. Remove this once # minimatch depends on a fixed release itself. "brace-expansion@>=5.0.0 <5.0.12": 5.0.12 +auditConfig: + ignoreGhsas: + # braces <= 3.0.3: stack exhaustion on deeply nested brace patterns. No + # fixed release exists (3.0.3 is the latest). The package is reached only + # through the lint toolchain (eslint-config-next > @next/eslint-plugin-next + # > fast-glob > micromatch), is not part of the built or deployed + # application, and only ever receives the glob patterns of this + # repository. Remove this entry as soon as braces or the Next.js lint + # plugin publishes a release without the advisory. + - GHSA-vfj7-8cjw-p6xm |