Skip to content

Commit

Permalink
[INTERNAL] Disable security audit warning for legacy semver (#847)
Browse files Browse the repository at this point in the history
  • Loading branch information
d3xter666 authored Jul 12, 2023
1 parent 03bbafb commit 0749dcf
Showing 1 changed file with 3 additions and 3 deletions.
6 changes: 3 additions & 3 deletions audit-ci.jsonc
Original file line number Diff line number Diff line change
Expand Up @@ -15,16 +15,16 @@
// Although this ReDoS attack is mainly applicable to servers, in theory a server could also send malicious headers to the client (UI5 Tooling) to cause an unexpected slowdown.
// However, this configured npm registry is already considered a trusted connection as code is downloaded and run by the client.
"GHSA-rc47-6667-2j5j",

// "cacheable-request" has a dependency to "http-cache-semantics" (GHSA-rc47-6667-2j5j) which is
// why it is considered as high severity. Not applicable as described above for GHSA-rc47-6667-2j5j.
"GHSA-8x6c-cv3v-vp6g",

// "semver" vulnerable to Regular Expression Denial of Service.
// "semver" is a dependency of "make-dir" that's only used in v2 branch. As we have decided to
// deprecate the v2 branch and encourage people to migrate their projects to v3, we are not
// considering fix for this.
"GHSA-c2qf-rxjj-qqgw|semver>", // Direct path
"GHSA-c2qf-rxjj-qqgw|semver", // Direct path
"GHSA-c2qf-rxjj-qqgw|*make-dir>semver*",
"GHSA-c2qf-rxjj-qqgw|*>normalize-package-data>semver*",
"GHSA-c2qf-rxjj-qqgw|*npm-package-arg>semver*"
Expand Down

0 comments on commit 0749dcf

Please sign in to comment.