Skip to content

Commit 3cdd53a

Browse files
authored
refactor: Add vitepress scan to the audit-ci's allowlist (#1202)
In order to receive valid reports and not to miss something, we shall silence this one for now
1 parent 2862cf3 commit 3cdd53a

File tree

1 file changed

+9
-1
lines changed

1 file changed

+9
-1
lines changed

audit-ci.jsonc

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,5 +2,13 @@
22
// $schema provides code completion hints to IDEs.
33
"$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
44
"low": true,
5-
"allowlist": []
5+
"allowlist": [
6+
// GHSA-67mh-4wv8-2f99 allows malicious websites to read localhost files while dev server runs.
7+
// We use VitePress for documentation build and all the information is already publicly available on GitHub Pages.
8+
// Exposure during local development doesn't leak confidential information.
9+
// This issue affects only the dev server. Production/CI builds are unaffected.
10+
//
11+
// Fix is available in VitePress 2.x with esbuild v0.25.x, but no stable release yet (only alpha).
12+
"GHSA-67mh-4wv8-2f99|vitepress>vite>esbuild"
13+
]
614
}

0 commit comments

Comments
 (0)