Skip to content

Commit b729194

Browse files
authored
ci: Skip checks for minimatch in dev (#1313)
This change complements #1312. The resoning is that we cannot easily bump `minimatch` from v3 to v10. It breaks the tools that are using it. Those are dev dependencies that are not used in productive code
1 parent d3c5ee9 commit b729194

File tree

1 file changed

+13
-1
lines changed

1 file changed

+13
-1
lines changed

audit-ci.jsonc

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,18 @@
99
// This issue affects only the dev server. Production/CI builds are unaffected.
1010
//
1111
// Fix is available in VitePress 2.x with esbuild v0.25.x, but no stable release yet (only alpha).
12-
"GHSA-67mh-4wv8-2f99|vitepress>vite>esbuild"
12+
"GHSA-67mh-4wv8-2f99|vitepress>vite>esbuild",
13+
14+
// We fix this vulnerability in the production code by overrides for the production build,
15+
// but the vulnerable version of minimatch is still used in development dependencies.
16+
// The reasoning is that it's a transitive dependency with a version that way bellow the fixed one (v3 vs v10) and
17+
// overriding such a version will break the development environment.
18+
"GHSA-3ppc-4f35-3m26|@eslint/eslintrc>minimatch>",
19+
"GHSA-3ppc-4f35-3m26|@istanbuljs/esm-loader-hook>test-exclude>minimatch",
20+
"GHSA-3ppc-4f35-3m26|babel-plugin-istanbul>test-exclude>minimatch",
21+
"GHSA-3ppc-4f35-3m26|eslint>@eslint/config-array>minimatch",
22+
"GHSA-3ppc-4f35-3m26|js-beautify>editorconfig>minimatch",
23+
"GHSA-3ppc-4f35-3m26|minimatch>",
24+
"GHSA-3ppc-4f35-3m26|nyc>test-exclude>minimatch",
1325
]
1426
}

0 commit comments

Comments
 (0)