-
Notifications
You must be signed in to change notification settings - Fork 98
Expand file tree
/
Copy pathosv-scanner.toml
More file actions
41 lines (34 loc) · 2.53 KB
/
Copy pathosv-scanner.toml
File metadata and controls
41 lines (34 loc) · 2.53 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
# OSV scanner exceptions for unresolved dev-tooling transitive vulnerabilities.
# These are currently non-runtime for the published plugin and tracked until upstream upgrades land.
[[IgnoredVulns]]
id = "GHSA-7r86-cg39-jmmj"
reason = "minimatch 9.0.3 is pinned by @typescript-eslint/typescript-estree via Salesforce dev tooling (dev/lint only)."
[[IgnoredVulns]]
id = "GHSA-3ppc-4f35-3m26"
reason = "minimatch 9.0.3 is pinned by @typescript-eslint/typescript-estree via Salesforce dev tooling (dev/lint only)."
[[IgnoredVulns]]
id = "GHSA-23c5-xmqv-rm74"
reason = "minimatch 9.0.3 is pinned by @typescript-eslint/typescript-estree via Salesforce dev tooling (dev/lint only)."
[[IgnoredVulns]]
id = "GHSA-5c6j-r48x-rmvq"
reason = "serialize-javascript 6.0.2 is brought by mocha from @salesforce/dev-scripts (test tooling only)."
[[IgnoredVulns]]
id = "GHSA-qj8w-gfj5-8c6v"
reason = "serialize-javascript 6.0.2 is brought by mocha from @salesforce/dev-scripts (test tooling only)."
# https://github.com/advisories/GHSA-5p2g-fcmc-qvqq (CVE-2025-71329)
# https://github.com/advisories/GHSA-w3rx-r6r6-pgpr (CVE-2025-71330)
# image-size: the JXL/HEIF box parser and the ICNS entry parser never advance the read offset when a
# size field is 0, so a crafted image spins the event loop forever (DoS, availability only).
# No patched release exists: OSV marks every version up to and including 2.0.2 as affected, and
# 2.0.2 is the current latest on npm (1.2.1 is the `legacy` tag). There is nothing to upgrade to.
# image-size 1.2.1 reaches us only through pptxgenjs 4.0.1 (`image-size "^1.2.1"`), used by
# src/common/utils/monitoringPptxReport.ts to build the monitoring PPTX report. That report is
# text and tables only: it never calls addImage, so the vulnerable parsers are never reached, and
# no image bytes from an untrusted source are ever handed to the library. Remove once image-size
# ships a fix and pptxgenjs picks it up. Added 2026-08-07.
[[IgnoredVulns]]
id = "GHSA-5p2g-fcmc-qvqq"
reason = "image-size 1.2.1 is a transitive dependency of pptxgenjs 4.0.1; no patched version exists (all releases up to the latest 2.0.2 are affected). Our PPTX report generates text and tables only and never decodes images, so the vulnerable JXL/HEIF parser is unreachable."
[[IgnoredVulns]]
id = "GHSA-w3rx-r6r6-pgpr"
reason = "image-size 1.2.1 is a transitive dependency of pptxgenjs 4.0.1; no patched version exists (all releases up to the latest 2.0.2 are affected). Our PPTX report generates text and tables only and never decodes images, so the vulnerable ICNS parser is unreachable."