From c30a50ceb522b184b4e85b0f001ca816100fcebf Mon Sep 17 00:00:00 2001 From: Charles Kelsoe Date: Mon, 15 Jun 2026 18:35:07 -0400 Subject: [PATCH] CI: suppress js-yaml dev-only OSV advisory GHSA-h67p-54hq-rp68 A newly disclosed moderate DoS in js-yaml (<= 4.1.1) is flagged by OSV-Scanner against js-yaml@3.14.2, a deep transitive dev dependency from the test-coverage toolchain (ts-jest -> istanbul -> load-nyc-config -> js-yaml). It is never in the shipped main.js and only parses our own trusted coverage config. The patch is js-yaml 4.2.0, but load-nyc-config needs the removed 3.x safeLoad API, so no non-breaking override exists. Document the acceptance in osv-scanner.toml and point the scanner at it, rather than dropping the severity gate. --- .github/workflows/ci.yml | 1 + osv-scanner.toml | 7 +++++++ 2 files changed, 8 insertions(+) create mode 100644 osv-scanner.toml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 5e14398..ed04b8d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -120,6 +120,7 @@ jobs: uses: google/osv-scanner-action/osv-scanner-action@v2.0.3 with: scan-args: |- + --config=osv-scanner.toml --lockfile=package-lock.json --recursive diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 0000000..b1bfd21 --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,7 @@ +# OSV-Scanner suppressions. Every entry must document why the advisory is +# accepted and what would let us drop it. Revisit whenever the dependency tree +# changes (a new lockfile may remove the transitive path entirely). + +[[IgnoredVulns]] +id = "GHSA-h67p-54hq-rp68" +reason = "js-yaml quadratic-complexity DoS in merge-key parsing (vulnerable <= 4.1.1, patched in 4.2.0). Reaches this repo only as js-yaml@3.14.2, a deep transitive DEV dependency: ts-jest -> @jest/transform -> babel-plugin-istanbul -> @istanbuljs/load-nyc-config -> js-yaml. It is never in the shipped main.js (esbuild bundles runtime deps only) and parses only our own trusted coverage config, not attacker-controlled input. No non-breaking fix exists: the patch is js-yaml 4.2.0, but load-nyc-config uses the 3.x safeLoad API removed in 4.x, so forcing an override would break the coverage loader. Drop this entry once load-nyc-config moves off js-yaml 3.x or the path leaves the tree."