chore(security): renew dependency-audit allowlist review dates#830
Merged
Conversation
The two dev-only HIGH allowlist entries (GHSA-p9ff-h696-f583 for vite via vitest, GHSA-737v-mqg7-c878 for the transitive defu dev dependency) passed the 60-day renewal-review window, which the strict audit gate rejects. Set reviewed_at to 2026-06-07 for both. The existing reason, why_not_exploitable, and remediation are unchanged: both are dev-only, not present in any published package, with no user-controlled input reaching them in production. expires_at (2026-07-06) is unchanged. This clears the strict audit gate (AUDIT_STRICT=1) and check-audit-exception- expiry --strict.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Renew the renewal-review date on the two dependency-audit allowlist entries that crossed the 60-day review window, which the strict audit gate (
AUDIT_STRICT=1) rejects. No code or dependency change.Scope
security/audit-allowlist.jsononly. Setsreviewed_at: "2026-06-07"onGHSA-p9ff-h696-f583(vite, via vitest) andGHSA-737v-mqg7-c878(defu, transitive dev dependency). No other field changes;expires_at(2026-07-06) is unchanged.Why
Both entries were added 2026-04-07 without a
reviewed_atdate. After 60 days the strict audit gate fails closed with "added 61 day(s) ago without reviewed_at (strict mode requires review within 60 days)". This is the intended periodic re-confirmation mechanism, not a new vulnerability.Re-confirmation
Both advisories remain dev-only and are not present in any published package:
GHSA-p9ff-h696-f583(vite dev-server arbitrary file read, HIGH): only used during local test runs via@vitest/coverage-v8 -> vitest -> vite; not in published packages or production deployments.GHSA-737v-mqg7-c878(defu prototype pollution, HIGH): transitive dev dependency in build/test tooling; no user-controlled input reaches it in production.Validation
AUDIT_STRICT=1 node scripts/audit-gate.mjs: OK (12 active exceptions, 0 invalid).node scripts/check-audit-exception-expiry.mjs --strict: GREEN.pnpm format:checkpasses.