From adaa902b32b89e1a778dbf0fc191fc53c5121485 Mon Sep 17 00:00:00 2001 From: Madhavendra Rathore Date: Wed, 5 Aug 2026 02:30:49 +0530 Subject: [PATCH] Revert the brace-expansion CVE suppressions from #463 Removes the two [[IgnoredVulns]] entries added in #463, restoring osv-scanner.toml to having no suppressions. The real dependency bumps from that PR are deliberately kept: brace-expansion 1.1.16 / 2.1.3 and ip-address 10.3.1 (the latter a production dependency via socks) all stay in package-lock.json. Why revert: [[IgnoredVulns]] entries are CVE-id global in OSV-Scanner v2.3.8 -- they silence the advisory across every package it is reported against, not just brace-expansion. That is broader than the problem being solved, and the entries landed inside a security PR without a security reviewer explicitly signing off on them. Backing them out so the decision can be made on its own merits. Consequence, intentional: the Security Scan gate fails again on three dev-only brace-expansion findings (GHSA-mh99-v99m-4gvg, GHSA-rgw5-rvv9-x895). There is no published fix -- the advisories name 1.1.17/1.1.18/2.1.4 but npm's latest releases are 1.1.16 and 2.1.3. These are dev-only: brace-expansion reaches us solely via the eslint/glob/test-exclude toolchains through minimatch, `npm ls brace-expansion --omit=dev` is empty, and both lockfile entries are marked "dev": true, so they are not reachable from the published dist/. Impact is DoS on adversarial brace patterns, which would require untrusted input to our own lint/test globs. Note the gate was already failing on main before #463 for these same dependencies, so this restores the prior state rather than causing a new regression. Signed-off-by: Madhavendra Rathore --- osv-scanner.toml | 26 -------------------------- 1 file changed, 26 deletions(-) diff --git a/osv-scanner.toml b/osv-scanner.toml index d34d8d9c..b15bf0d4 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -30,29 +30,3 @@ # This file starts empty -- populate iteratively as the first scan run # surfaces real false positives or dev-only findings worth excluding. # Do not pre-populate with speculative suppressions. - -# brace-expansion DoS advisories, both with NO published fix as of -# 2026-08-05: the advisories name 1.1.17/1.1.18 and 2.1.4 as fixed, but -# npm's latest published releases are 1.1.16 and 2.1.3. So there is -# nothing to bump to -- we already bumped as far as the registry allows -# (1.1.15 -> 1.1.16, 2.1.1 -> 2.1.3, which cleared the earlier -# GHSA-3jxr-9vmj-r5cp). -# -# Dev-only: brace-expansion reaches us solely through the eslint / -# glob / test-exclude toolchains via minimatch. `npm ls brace-expansion -# --omit=dev` is empty, and both lockfile entries are marked -# "dev": true, so it is not reachable from the published dist/. -# The impact is DoS (ReDoS / OOM) on adversarial brace patterns, which -# would require untrusted input to our own lint/test globs. -# -# Revisit when 1.1.18 / 2.1.4 land on npm and drop these entries. - -[[IgnoredVulns]] -id = "GHSA-mh99-v99m-4gvg" -ignoreUntil = "2027-02-05T00:00:00Z" -reason = "dev-only (eslint/glob/test-exclude -> minimatch); not reachable from shipped dist/. No published fix: advisory lists 1.1.17 as fixed but 1.1.16 is npm's latest 1.x." - -[[IgnoredVulns]] -id = "GHSA-rgw5-rvv9-x895" -ignoreUntil = "2027-02-05T00:00:00Z" -reason = "dev-only (eslint/glob/test-exclude -> minimatch); not reachable from shipped dist/. No published fix: advisory lists 1.1.18/2.1.4 as fixed but npm's latest are 1.1.16/2.1.3."