fix(security): risk-accept pygments ReDoS GHSA-5239-wwwm-4pmq (ENG-13187)

[andriy-sudo]

Vulnerability Risk Acceptance

Package	Version	Advisory	CVSS	Status
pygments	2.19.2	GHSA-5239-wwwm-4pmq	3.3 LOW	⚠️ Risk accepted — no fix available

Why risk acceptance

pygments 2.19.2 is the latest published release and is marked last_affected in the advisory — upstream has not released a patched version. No semver-compatible fix exists.

The ReDoS is exploitable only with local access and requires attacker-controlled syntax highlighting inputs (ADL/archetype files fed to AdlLexer). This is not a realistic attack vector in our deployment.

ignoreUntil: 2026-06-23 — will re-evaluate when a patched pygments release is available.

Linear ticket

Closes ENG-13187

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 3dbd2daf-64d6-4b09-bca8-94704614692d

📥 Commits

Reviewing files that changed from the base of the PR and between 53962ad and 8060f6d.

📒 Files selected for processing (1)

• osv-scanner.toml

✅ Files skipped from review due to trivial changes (1)

• osv-scanner.toml

---

📝 Walkthrough

Walkthrough

A new vulnerability ignore entry was added to osv-scanner.toml for GHSA-5239-wwwm-4pmq, set to be ignored until 2026-06-23T00:00:00Z. The reason notes LOW severity (CVSS 3.3) for a pygments ReDoS in AdlLexer and that no fix version has been published. This change only updates scanner configuration and does not modify code or runtime control flow.

🚥 Pre-merge checks | ✅ 2

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main change: accepting a security risk for a pygments ReDoS vulnerability (GHSA-5239-wwwm-4pmq) and documenting it in the configuration.
Description check	✅ Passed	The description directly relates to the changeset by explaining the vulnerability risk acceptance for pygments, providing context on why it was accepted and when it will be re-evaluated.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch andriy/ENG-13187-fix-pygments-ghsa-5239-wwwm-4pmq

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}