Skip to content

chore: remove auditConfig.ignoreGhsas#588

Closed
btravers with Copilot wants to merge 3 commits into
mainfrom
copilot/remove-every-auditconfig-ignoreghsas
Closed

chore: remove auditConfig.ignoreGhsas#588
btravers with Copilot wants to merge 3 commits into
mainfrom
copilot/remove-every-auditconfig-ignoreghsas

Conversation

Copilot AI commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Drops all 8 suppressed GHSA advisories from pnpm-workspace.yaml. These suppressions mask known vulnerabilities from pnpm audit and should not be silenced long-term.

Changes

  • pnpm-workspace.yaml: Remove the entire auditConfig.ignoreGhsas block

@btravers

Copy link
Copy Markdown
Contributor

@copilot CI must pass

Add pnpm overrides to fix the 6 HIGH vulnerabilities exposed after
removing auditConfig.ignoreGhsas:

- GHSA-3jxr-9vmj-r5cp (brace-expansion DoS): override @1→1.1.16,
  @2→2.1.2, @5→5.0.7
- GHSA-52cp-r559-cp3m (js-yaml quadratic CPU): override @3→3.15.0,
  @4→4.3.0
- GHSA-fx2h-pf6j-xcff (vite server.fs.deny bypass): no patch exists in
  vite 5.x; force global vite to 8.0.16 (already-installed patched
  version used by vitest). Add peerDependencyRules.allowedVersions to
  allow @vitejs/plugin-vue@5.x to accept vite 8.x as a peer.

`pnpm audit --audit-level=high` now exits 0 (only 1 low + 2 moderate
remain, all below the threshold).

Copilot AI commented Jul 20, 2026

Copy link
Copy Markdown
Contributor Author

@copilot CI must pass

Fixed in the latest commit. The 6 HIGH vulnerabilities exposed by removing ignoreGhsas are now resolved with pnpm overrides:

  • GHSA-3jxr-9vmj-r5cp (brace-expansion): @1→1.1.16, @2→2.1.2, @5→5.0.7
  • GHSA-52cp-r559-cp3m (js-yaml): @3→3.15.0, @4→4.3.0
  • GHSA-fx2h-pf6j-xcff (vite): no patch exists in vite 5.x; forced global vite to 8.0.16 (the already-installed version used by vitest). Added peerDependencyRules.allowedVersions to satisfy @vitejs/plugin-vue@5.x's peer dep.

pnpm audit --audit-level=high now exits 0 locally (only 1 low + 2 moderate remain).

Copilot AI requested a review from btravers July 20, 2026 23:13
@btravers btravers closed this Jul 21, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants