audit-ci.jsonc

{
    // Fail on high severity and above. See README "Accepted security advisories" for
    // why each allowlisted entry is safe to defer.
    "$schema": "https://github.com/IBM/audit-ci/raw/main/docs/schema.json",
    "high": true,
    "allowlist": [
        {
            "GHSA-w5hq-g745-h8pq": {
                // Added: 2026-05-22
                "active": true,
                "notes": "`uuid` <11.1.1 (via `postman-request`): vulnerable code path is `v3()`/`v5()`/`v6()` when a caller-provided buffer is passed. The only consumer in this dep graph calls `v4()` (no buffer arg), so the vulnerable path is unreachable."
            }
        }
    ]
}