Remove auditConfig.ignoreGhsas

.agents/rules/dependencies.md

@@ -48,7 +48,7 @@ When you add a peer dep, also add it to `devDependencies` (with the same `"catal
 
 ## Security `overrides` (`pnpm-workspace.yaml`)
 
-`pnpm-workspace.yaml` pins minimum versions for transitive dependencies via its `overrides:` block to close known CVEs (currently `fast-uri`, `protobufjs`, and `testcontainers>undici`). When a security audit flags a new vulnerability, add the pin there (with a comment citing the GHSA and the reachability reasoning) rather than waiting for upstream to update. Advisories that are unreachable in this repo are suppressed via `auditConfig.ignoreGhsas`, each with a documented justification.
+`pnpm-workspace.yaml` pins minimum versions for transitive dependencies via its `overrides:` block to close known CVEs (currently `fast-uri`, `protobufjs`, and `testcontainers>undici`). When a security audit flags a new vulnerability, add the pin there (with a comment citing the GHSA and the reachability reasoning) rather than waiting for upstream to update. Advisories that have no available fix (e.g. a vulnerability where the patched version is only available in a newer major that the depending package cannot yet adopt) are handled by `--ignore-unfixable` in the CI audit command rather than suppressing by GHSA ID.
 
 ## Monorepo Conventions
 

.github/workflows/ci.yml

@@ -154,7 +154,7 @@ jobs:
         uses: ./.github/actions/setup
 
       - name: Run security audit
-        run: pnpm audit --audit-level=high
+        run: pnpm audit --audit-level=high --ignore-unfixable
 
   bundle-size:
     name: Bundle Size

pnpm-workspace.yaml

@@ -36,22 +36,6 @@ overrides:
   read-yaml-file>js-yaml: "^3.15.0"
   "@changesets/parse>js-yaml": ">=4.3.0"
 
-# esbuild <0.28.1 advisory (GHSA-gv7w-rqvm-qjhr): a Deno-only dev-server binary
-# integrity issue. Only reachable transitively via vitepress>vite>esbuild, and
-# vitepress pins a vite that is incompatible with esbuild 0.28.x (its build
-# crashes transforming destructuring). Not exploitable for a static docs build,
-# so it is ignored until vitepress ships a vite compatible with the fixed esbuild.
-#
-# vite <=6.4.2 advisory (GHSA-fx2h-pf6j-xcff): a `server.fs.deny` bypass on
-# Windows alternate paths in `vite dev`. Only reachable transitively via
-# vitepress 1.x, which pins vite 5.x; the fix exists only in vite 6.4.3+. The
-# bypass affects the dev server only and is not exploitable for the static
-# `vitepress build` output we ship, so it is ignored until vitepress 2.x lands.
-auditConfig:
-  ignoreGhsas:
-    - "GHSA-gv7w-rqvm-qjhr"
-    - "GHSA-fx2h-pf6j-xcff"
-
 packages:
   - packages/*
   - examples/*
@@ -107,3 +91,4 @@ minimumReleaseAgeExclude:
   - "@btravstack/theme"
   - "unthrown"
   - "@unthrown/vitest"
+auditConfig: { ignoreGhsas: null }