Cam Proudlock
a8f8580738
Clears every shipped finding the SBOM scan reported: pyjwt 2.13.0, idna 3.19, axios 1.20.0, postcss 8.5.26, dompurify 3.4.14, nanoid 3.3.18, follow-redirects 1.16.0, form-data 4.0.6. All in-major bumps inside ranges the manifests already allowed, so this is a lockfile refresh rather than a migration. The axios and dompurify floors were raised to match, since the old ones still nominally admitted the vulnerable range. The PyJWT allowlist entry was removed rather than kept - it stopped matching once the upgrade landed. Verified: full suite 2161 passed, frontend 273 passed, build clean, npm audit --omit=dev reports 0 vulnerabilities.
24 lines
1.1 KiB
JSON
24 lines
1.1 KiB
JSON
{
|
|
"_comment": [
|
|
"Advisories reviewed and accepted, with the reason and the date.",
|
|
"This is a RECORD, not a mute button: an entry says somebody looked at",
|
|
"the advisory and worked out why it does not apply here. Anyone can",
|
|
"re-read the reason and disagree.",
|
|
"",
|
|
"An entry needs an id, a reason that names the precondition that is",
|
|
"absent, who accepted it, and when. 'reviewuntil' is when the reasoning",
|
|
"should be checked again - a reason stops being true when the code that",
|
|
"made it true changes, and 'invalidatedby' should say what that change",
|
|
"would be.",
|
|
"",
|
|
"Currently EMPTY, which is the state to aim for. The one entry this file",
|
|
"has held so far - a PyJWT algorithm-confusion advisory that needed a",
|
|
"configuration this application does not use - was removed by upgrading",
|
|
"PyJWT rather than by keeping the exception.",
|
|
"",
|
|
"Do NOT add an entry to make a build pass. Upgrading the dependency is",
|
|
"almost always cheaper than defending a decision to skip it."
|
|
],
|
|
"accepted": []
|
|
}
|