mirror of
https://github.com/MBombeck/HealthLog.git
synced 2026-11-08 20:42:43 +00:00
Marc-André Bombeck
b50b5fcd21
react-hook-form, @hookform/resolvers, next-themes and @vitejs/plugin-react have no import anywhere in src/, scripts/, tests/, e2e/ or the build and test configs; knip only stayed quiet because each sat on its ignore list. Forms keep a controlled draft and validate with the shared Zod schemas, and the theme bootstrap is hand-written. The ignore entries, the comments that still named the form library, and the guideline text go with them.
133 lines
6.5 KiB
YAML
133 lines
6.5 KiB
YAML
overrides:
|
|
# CVE-2026-84375 (js-yaml < 4.3.2, HIGH), CVE-2026-84363/84364/84365 (hono
|
|
# < 4.13.5, via @hono/node-server under the MCP SDK), CVE-2026-45819
|
|
# (baseline-browser-mapping < 2.11.0), GHSA-rgj7-g3m4-5g8c (sharp < 0.35.4,
|
|
# pulled by next). None is a direct dependency; the bounds move the copies
|
|
# the scanner flags and nothing else.
|
|
"js-yaml@<4.3.2": "^4.3.2"
|
|
"hono@<4.13.5": "^4.13.5"
|
|
"baseline-browser-mapping@<2.11.0": "^2.11.0"
|
|
"sharp@<0.35.4": "^0.35.4"
|
|
# GHSA-55q2-fjhq-7xh7: a crafted document gets past the sanitiser and its
|
|
# markup survives into the output. The copy here is jspdf's optional HTML
|
|
# renderer, which the doctor-report PDF path reaches.
|
|
# A later advisory against 3.4.13 to 3.4.15 raised the floor to 3.4.16.
|
|
"dompurify@<3.4.16": "^3.4.16"
|
|
# CVE-2026-69153. Next declares an exact `postcss@8.4.31`, so nothing except
|
|
# this bound moves it. The build has run on the 8.5 line since the first
|
|
# bump; the fix landed in 8.5.23.
|
|
"postcss@<8.5.23": "^8.5.23"
|
|
"nanoid@<3.3.18": "^3.3.18"
|
|
# GHSA-frvp-7c67-39w9 raised the floor from 1.19.13 to 1.19.15. Mirrored for
|
|
# /opt/prisma-cli in the Dockerfile, which is where the flagged 1.19.11
|
|
# actually landed: prisma pulls it through @prisma/dev, and that install
|
|
# reads npm `overrides`, not this file. The bound stays on the 1.x line
|
|
# because the advisory is fixed there too and 2.x is a major nothing asked
|
|
# for.
|
|
"@hono/node-server@<1.19.15": "^1.19.15"
|
|
"picomatch@<4.0.4": "^4.0.4"
|
|
"body-parser@<2.3.0": "^2.3.0"
|
|
# CVE-2026-93749 (source-map-js < 1.2.2, HIGH, under postcss and the
|
|
# Tailwind build), CVE-2026-104844 (postcss-selector-parser < 7.1.6, under
|
|
# shadcn) and GHSA-r4xh-jqrq-34v2 (smol-toml < 1.9.0, under knip). All three
|
|
# are quadratic-time parsers reached at build or dev time only.
|
|
"source-map-js@<1.2.2": "^1.2.2"
|
|
"postcss-selector-parser@<7.1.6": "^7.1.6"
|
|
"smol-toml@<1.9.0": "^1.9.0"
|
|
# Array-limit bypass through bracket-key comma parsing, and a denial of
|
|
# service through an attacker-controlled isBuffer. 6.16.0 covers both.
|
|
"qs@<6.16.0": "^6.16.0"
|
|
# GHSA-jqff-g426-hqxp and three siblings: host confusion and request
|
|
# forgery through percent-encoded schemes, skipped IDN canonicalisation and
|
|
# malformed authorities. It arrives under ajv, including the connector SDK's
|
|
# copy, so it sits on a path this app exposes.
|
|
# Authority injection through an unvalidated port in serialize, and a
|
|
# follow-up fixed in 3.1.8, raised the floor from 3.1.6.
|
|
"fast-uri@<3.1.8": "^3.1.8"
|
|
"flatted@<3.4.2": "^3.4.2"
|
|
# GHSA-jqcg-44mw-7w3h: IP spoofing through IPv4-mapped addresses. It
|
|
# arrives under express in the MCP SDK; the app resolves client IPs itself,
|
|
# but the copy sits on a production path.
|
|
"proxy-addr@<2.0.8": "^2.0.8"
|
|
# GHSA-3f6p-5ww8-9rcr: auth-plugin downgrade leaking plaintext credentials.
|
|
# Reached only through prisma's MySQL driver, which this app never opens;
|
|
# pinned so the audit reads clean, and mirrored for /opt/prisma-cli in the
|
|
# Dockerfile.
|
|
"mysql2@<3.22.0": "^3.22.0"
|
|
# The scanner suggests 10.x (latest), but the ReDoS fix is backported: only
|
|
# <3.1.4 is vulnerable, so the 3.x line stays where its consumers expect it.
|
|
"minimatch@<3.1.4": "^3.1.4"
|
|
# Address4 decoded leading-zero octets as decimal, so `010.0.0.1` parsed as
|
|
# 10.0.0.1 rather than being rejected. That is the exact alt-notation class
|
|
# `isPublicUrl` exists to catch, and this copy arrives under the MCP SDK's
|
|
# rate limiter where nothing of ours screens it.
|
|
# Later advisories up to 10.7.0 raised the floor from 10.3.1 to 10.7.1.
|
|
"ip-address@<10.7.1": "^10.7.1"
|
|
"sharp@<0.35.0": "^0.35.3"
|
|
# A crafted PDF could run arbitrary JavaScript through the renderer. Our own
|
|
# copy is pinned past it in `devDependencies`, but a second copy arrives
|
|
# transitively, and `outputFileTracingIncludes` ships EVERY `pdfjs-dist@*` in
|
|
# the store into the standalone image — so an unused transitive copy is still
|
|
# a copy in the runtime image. The range is bounded on both ends deliberately:
|
|
# `pdf-parse` resolves 5.4.296, which predates the flaw and drives the local
|
|
# text-extraction path, so it must not be dragged onto a new major.
|
|
"pdfjs-dist@>=5.6.83 <6.2.108": "6.2.108"
|
|
# Deeply nested input drives DeepmergeTS into unbounded recursion until the
|
|
# stack gives out. The copy here is Prisma's: `@prisma/config` still asks for
|
|
# 7.1.5 even on the current 7.9.1, so no Prisma bump reaches it and the
|
|
# override is the only way through. It runs on the config-loading and CLI
|
|
# path, not under a request, but a red audit blocks the whole release train.
|
|
"deepmerge-ts@<8.0.0": "^8.0.0"
|
|
# CVE-2026-59952. The copy arrives through prisma's local dev server, not
|
|
# ours to call. Mirrored for /opt/prisma-cli in the Dockerfile,
|
|
# where the flagged 1.2.0 landed. 1.4.2 is the same major, so no consumer is
|
|
# dragged onto a new one.
|
|
"valibot@<1.4.2": "^1.4.2"
|
|
|
|
# GHSA-p498-v437-472g. eslint's filesystem layer; development-only, but the
|
|
# floor costs nothing and keeps the advisory list at zero so a real one is
|
|
# not lost in the noise.
|
|
"@humanfs/node@<0.16.8": "^0.16.8"
|
|
|
|
# GHSA-g7r4-m6w7-qqqr. Reached through the test tooling, never shipped. The
|
|
# patched line is the same minor, so nothing downstream moves.
|
|
"esbuild@>=0.27.3 <0.28.1": "^0.28.1"
|
|
|
|
# Development-only copies (test containers, build tooling) that the
|
|
# dependency alerts flag: gRPC under the test containers, brace-expansion on
|
|
# three major lines, and undici 7 next to the app's own undici 8.
|
|
"@grpc/grpc-js@>=1.14.0 <1.14.5": "^1.14.5"
|
|
"brace-expansion@<1.1.21": "^1.1.21"
|
|
"brace-expansion@>=2.0.0 <2.1.7": "^2.1.7"
|
|
"brace-expansion@>=4.0.0 <5.0.12": "^5.0.12"
|
|
"undici@>=7.0.0 <7.29.1": "^7.29.1"
|
|
|
|
allowBuilds:
|
|
"@prisma/engines": true
|
|
prisma: true
|
|
core-js: false
|
|
cpu-features: false
|
|
esbuild: false
|
|
lefthook: false
|
|
msw: false
|
|
protobufjs: false
|
|
sharp: false
|
|
ssh2: false
|
|
tesseract.js: false
|
|
unrs-resolver: false
|
|
|
|
minimumReleaseAgeExclude:
|
|
- "@next/bundle-analyzer@16.2.12"
|
|
- lucide-react@1.27.0
|
|
- undici@8.10.0
|
|
|
|
auditConfig:
|
|
ignoreGhsas:
|
|
# node-forge <=1.4.0, RSA PKCS#1 v1.5 signature verification. It arrives
|
|
# only through @parse/node-apn, which uses it for certificate-based APNs
|
|
# credentials (p12 / PEM certificate). HealthLog authenticates to APNs
|
|
# with a token (.p8 key, APNS_KEY_ID / APNS_TEAM_ID), so that code path
|
|
# never runs. No patched release is published yet (latest is 1.4.0);
|
|
# remove this entry and raise the floor once 1.4.1 is out.
|
|
- GHSA-86w9-cpqp-85rv
|