From 9bba274b75100c3c071ba79a7c6fc4d69f9b36be Mon Sep 17 00:00:00 2001 From: Ronny Trommer Date: Thu, 15 Oct 2026 11:09:52 +0200 Subject: [PATCH] fix(docs): patch webpack-dev-middleware and record accepted braces risk Refresh webpack-dev-middleware to 7.4.6 (GHSA-g84c-rxfj-3j2c) within the range webpack-dev-server allows. Add osv-scanner.toml ignoring GHSA-vfj7-8cjw-p6xm until 2027-04-15. braces 3.0.3 has no patched release and Scorecard does not see the Dependabot dismissal from #330. Closes #332 Assisted-by: ClaudeCode:claude-opus-5-5 Signed-off-by: Ronny Trommer --- osv-scanner.toml | 9 +++++++++ package-lock.json | 6 +++--- 2 files changed, 12 insertions(+), 3 deletions(-) create mode 100644 osv-scanner.toml diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 0000000..2b1126c --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,9 @@ +# SPDX-License-Identifier: GPL-3.0-or-later +# +# Known vulnerabilities accepted for the docs site's package-lock.json. +# OpenSSF Scorecard reads this file; Dependabot dismissals do not reach it. + +[[IgnoredVulns]] +id = "GHSA-vfj7-8cjw-p6xm" +ignoreUntil = 2027-04-15 +reason = "braces 3.0.3 has no patched release. Build-time only dependency of the docs site via Docusaurus (chokidar, micromatch). Its inputs are the repo's own glob patterns, not untrusted data. See #330." diff --git a/package-lock.json b/package-lock.json index aae68b3..709fc93 100644 --- a/package-lock.json +++ b/package-lock.json @@ -20784,9 +20784,9 @@ } }, "node_modules/webpack-dev-middleware": { - "version": "7.4.5", - "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-7.4.5.tgz", - "integrity": "sha512-uxQ6YqGdE4hgDKNf7hUiPXOdtkXvBJXrfEGYSx7P7LC8hnUYGK70X6xQXUvXeNyBDDcsiQXpG2m3G9vxowaEuA==", + "version": "7.4.6", + "resolved": "https://registry.npmjs.org/webpack-dev-middleware/-/webpack-dev-middleware-7.4.6.tgz", + "integrity": "sha512-yBWCMvIfUmuhAE8vdqUKzH0vg9kuWN0KeG4vBnqRplUFHRU7lMQjkiJWxVQzvo2BTewqhPhDlMB41rAt2jVA9A==", "license": "MIT", "dependencies": { "colorette": "^2.0.10",