External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(security): resolve 13 HIGH Trivy CVEs in npm dependencies

Browse Source 
- Override glob>=10.5.0 (CVE-2025-64756 command injection)
- Override minimatch>=9.0.6 (CVE-2026-26996/27903/27904 ReDoS)
- Override tar>=7.5.11 (CVE-2026-23745/23950/24842/26960/29786/31802
  path traversal and arbitrary file overwrite)
- picomatch>=4.0.4 already overridden (CVE-2026-33671 ReDoS)
- Add .trivyignore for pnpm 9.x CVEs (CVE-2025-69262/69263) that
  require a major version bump to pnpm 10.x
- Restore Trivy as a blocking gate with trivyignore support
- Restore scan dependency in manifest job
This commit is contained in:
SnapOtter
2026-06-08 16:32:52 +08:00
parent 2c0a04c195
commit 012e2136ee
4 changed files with 22 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.trivyignore
+6
View File
@@ -0,0 +1,6 @@
# pnpm 9.x CVEs -- requires major version bump to pnpm 10.x
# These are build-time tool vulnerabilities, not runtime application code.
# pnpm is only used for dependency installation, not user-facing functionality.
# Tracked for upgrade: https://github.com/pnpm/pnpm/releases/tag/v10.0.0
CVE-2025-69262
CVE-2025-69263