Skip to content

deps: fast-uri ^3.1.9 (osv) #52

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
bdelanghe merged 2 commits into from
Oct 27, 2026
Merged

deps: fast-uri ^3.1.9 (osv) #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
c070069
deps: fast-uri ^3.1.9 (osv red)
bdelanghe Oct 27, 2026
ba02aa7
osv: accept lume-pinned markdown-it advisories until 2026-11-27 (buil…
bdelanghe Oct 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion deno.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
// Accepting this one would have been wrong — it is fixable, and 7.5 is the
// highest severity this lane has flagged here since the linkify-it 8.7.
// Remove once deno advances the transitive unaided.
"fast-uri": "npm:fast-uri@^3.1.6",
"fast-uri": "npm:fast-uri@^3.1.9",
"ajv-formats": "npm:ajv-formats@^3.0.1",
"deno-dom-wasm": "https://deno.land/x/deno_dom/deno-dom-wasm.ts",
"lume/": "https://deno.land/x/lume@v3.2.5/",
Expand Down
8 changes: 4 additions & 4 deletions deno.lock
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

28 changes: 25 additions & 3 deletions osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
# Acceptances for the shared osv-scan lane. See ci-workflows/REMEDIATION.md.
#
# Two entries, both reached only through lume's exact npm pins, both dated.
# Six entries, all reached only through lume's exact npm pins, all dated. 2026-10-27: the two original
# entries were re-checked (lume v3.2.5 is still the newest and still pins markdown-it 14.1.1 and esbuild 0.28.0)
# and re-dated to 2026-11-27; four new markdown-it advisories were added on the same footing (bounded-systems/fold-engine#51).
# Everything else this repo was failing on — 8 of 9 advisories, including a
# CVSS 8.7 in linkify-it — was FIXED at rungs 1 and 2, not accepted.
#
Expand All @@ -18,10 +20,30 @@

[[IgnoredVulns]]
id = "GHSA-6v5v-wf23-fmfq"
ignoreUntil = 2026-10-31
ignoreUntil = 2026-11-27
reason = "MARKDOWN-IT. 14.1.1, fixed in 14.2.0. Reached only through lume, whose deps/markdown_it.ts pins npm:markdown-it@14.1.1 EXACTLY — checked v3.2.2, v3.2.4 and v3.2.5, the newest published, and all three carry the same exact pin, so rung 2 is exhausted. Rung 3 was attempted and does not apply: promoting markdown-it to a direct import in deno.json leaves the lock resolving 14.1.1, because an import-map entry can only redirect a BARE specifier and lume's is fully qualified. Nothing in src/ imports markdown-it directly. Remaining options were this or vendoring lume. Severity 5.3, the lowest of the nine findings this lane surfaced here. REMOVE THIS when lume's deps/markdown_it.ts moves to >=14.2.0 — check with: curl -s https://deno.land/x/lume@<newest>/deps/markdown_it.ts | grep markdown-it, and get <newest> from https://cdn.deno.land/lume/meta/versions.json"

[[IgnoredVulns]]
id = "GHSA-g7r4-m6w7-qqqr"
ignoreUntil = 2026-10-31
ignoreUntil = 2026-11-27
reason = "ESBUILD. 0.28.0, affected range is introduced 0.27.3 / fixed 0.28.1 — so this is narrow, and no lume release pins inside the fixed window: v3.2.2 pins 0.27.3, v3.2.4 and v3.2.5 pin 0.28.0. Same exact-pin structure as the markdown-it entry above, so rungs 1-3 fail for the same reason: nothing in src/ imports esbuild, and an import-map entry cannot redirect lume's fully-qualified specifier. Introduced BY the lume v3.1.4 -> v3.2.5 bump in this PR, deliberately and with the trade recorded in the header comment. CVSS 2.5, and the vector is local with integrity-only impact (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N) — it needs local access to a build host, which is a narrower exposure than the 8.7 this bump helped clear. REMOVE THIS when lume pins esbuild >=0.28.1 — check with: curl -s https://deno.land/x/lume@<newest>/deps/esbuild.ts | grep esbuild, and get <newest> from https://cdn.deno.land/lume/meta/versions.json"

[[IgnoredVulns]]
id = "GHSA-253c-mchw-3w2r"
ignoreUntil = 2026-11-27
reason = "MARKDOWN-IT 14.1.1 (CVSS 6.3), fixed in 14.3.3. Reached only through lume v3.2.5's deps/markdown_it.ts, which pins npm:markdown-it@14.1.1 EXACTLY; v3.2.5 is the newest lume (checked 2026-10-27), and an import-map entry cannot redirect lume's fully qualified specifier (see the GHSA-6v5v-wf23-fmfq entry). Exposure: markdown-it runs at BUILD time in src/unfold/site/site.ts over this repo's own content and Bobby's own vault, never over third-party or request-time input. Decided by recommendation in fold-engine#51 (accept, dated) over vendoring lume. REMOVE THIS when lume pins markdown-it >=14.3.3; same check as the GHSA-6v5v-wf23-fmfq entry."

[[IgnoredVulns]]
id = "GHSA-gfr2-rv44-r23c"
ignoreUntil = 2026-11-27
reason = "MARKDOWN-IT 14.1.1 (CVSS 7.5), fixed in 14.3.3. Reached only through lume v3.2.5's deps/markdown_it.ts, which pins npm:markdown-it@14.1.1 EXACTLY; v3.2.5 is the newest lume (checked 2026-10-27), and an import-map entry cannot redirect lume's fully qualified specifier (see the GHSA-6v5v-wf23-fmfq entry). Exposure: markdown-it runs at BUILD time in src/unfold/site/site.ts over this repo's own content and Bobby's own vault, never over third-party or request-time input. Decided by recommendation in fold-engine#51 (accept, dated) over vendoring lume. REMOVE THIS when lume pins markdown-it >=14.3.3; same check as the GHSA-6v5v-wf23-fmfq entry."

[[IgnoredVulns]]
id = "GHSA-r7fv-28h4-cvq7"
ignoreUntil = 2026-11-27
reason = "MARKDOWN-IT 14.1.1 (CVSS 7.5), fixed in 14.3.3. Reached only through lume v3.2.5's deps/markdown_it.ts, which pins npm:markdown-it@14.1.1 EXACTLY; v3.2.5 is the newest lume (checked 2026-10-27), and an import-map entry cannot redirect lume's fully qualified specifier (see the GHSA-6v5v-wf23-fmfq entry). Exposure: markdown-it runs at BUILD time in src/unfold/site/site.ts over this repo's own content and Bobby's own vault, never over third-party or request-time input. Decided by recommendation in fold-engine#51 (accept, dated) over vendoring lume. REMOVE THIS when lume pins markdown-it >=14.3.3; same check as the GHSA-6v5v-wf23-fmfq entry."

[[IgnoredVulns]]
id = "GHSA-vfgh-jcmw-g37q"
ignoreUntil = 2026-11-27
reason = "MARKDOWN-IT 14.1.1 (CVSS 3.7), fixed in 14.3.3. Reached only through lume v3.2.5's deps/markdown_it.ts, which pins npm:markdown-it@14.1.1 EXACTLY; v3.2.5 is the newest lume (checked 2026-10-27), and an import-map entry cannot redirect lume's fully qualified specifier (see the GHSA-6v5v-wf23-fmfq entry). Exposure: markdown-it runs at BUILD time in src/unfold/site/site.ts over this repo's own content and Bobby's own vault, never over third-party or request-time input. Decided by recommendation in fold-engine#51 (accept, dated) over vendoring lume. REMOVE THIS when lume pins markdown-it >=14.3.3; same check as the GHSA-6v5v-wf23-fmfq entry."
Loading