From 00fdee6f0cd8cf77a1e8bb20d71e9b484748734a Mon Sep 17 00:00:00 2001 From: Merlin Beutlberger Date: Tue, 13 Oct 2026 15:39:48 +0200 Subject: [PATCH] ci: Ignore invalid and unpatchable CVEs Several recently reported CVEs are invalid according to the respective maintainers. No patches are available and no immediate risk for our usage, therefore ignoring the audit findings. --- audit-ci.jsonc | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/audit-ci.jsonc b/audit-ci.jsonc index a386d06e337..52e3a86970d 100644 --- a/audit-ci.jsonc +++ b/audit-ci.jsonc @@ -32,6 +32,15 @@ // GHSA-v6wh-96g9-6wx3: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows // Not applicable as we don't use launch-editor. - "GHSA-v6wh-96g9-6wx3|vitepress>vite" + "GHSA-v6wh-96g9-6wx3|vitepress>vite", + + // AI slop CVEs (not applicable) - See dependabot alert dismissals for details + "GHSA-ch52-4w7c-c8xp|http-cache-semantics", + "GHSA-hp3w-g68c-fv3c|@istanbuljs/esm-loader-hook>@istanbuljs/load-nyc-config>js-yaml>argparse>sprintf-js", + "GHSA-hp3w-g68c-fv3c|ava>supertap>js-yaml>argparse>sprintf-js", + "GHSA-hp3w-g68c-fv3c|babel-plugin-istanbul>@istanbuljs/load-nyc-config>js-yaml>argparse>sprintf-js>", + "GHSA-hp3w-g68c-fv3c|nyc>@istanbuljs/load-nyc-config>js-yaml>argparse>sprintf-js", + "GHSA-vfj7-8cjw-p6xm|globby>fast-glob>micromatch>braces", + "GHSA-vfj7-8cjw-p6xm|micromatch>braces>" ] }