SnapOtter

mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00

Files

T

SnapOtter 012e2136ee fix(security): resolve 13 HIGH Trivy CVEs in npm dependencies

- Override glob>=10.5.0 (CVE-2025-64756 command injection)
- Override minimatch>=9.0.6 (CVE-2026-26996/27903/27904 ReDoS)
- Override tar>=7.5.11 (CVE-2026-23745/23950/24842/26960/29786/31802
  path traversal and arbitrary file overwrite)
- picomatch>=4.0.4 already overridden (CVE-2026-33671 ReDoS)
- Add .trivyignore for pnpm 9.x CVEs (CVE-2025-69262/69263) that
  require a major version bump to pnpm 10.x
- Restore Trivy as a blocking gate with trivyignore support
- Restore scan dependency in manifest job

2026-06-08 16:32:52 +08:00

ci.yml

fix(ci): ignore new torch/joblib/markdown CVEs in pip-audit

2026-05-20 16:27:54 +08:00

cla.yml

chore: harden OpenSSF Scorecard from 4.3 to ~7.0 (#142 )

2026-05-18 15:57:17 +08:00

codeql.yml

chore(deps): bump the actions group with 5 updates (#186 )

2026-06-04 21:48:16 +08:00

dependency-review.yml

chore(deps): bump the actions group across 1 directory with 11 updates (#143 )