Skip to content

chore(audit): scope osv-scanner to production dependencies #127

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
WomB0ComB0 wants to merge 2 commits into
base: master
Choose a base branch
from
+73 −0
Open

chore(audit): scope osv-scanner to production dependencies #127

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
63e1e55
chore(audit): scope osv-scanner to production dependencies
WomB0ComB0 Jun 17, 2026
d3fc0b0
Merge branch 'master' into chore/osv-scanner-scope-audit
WomB0ComB0 Jun 17, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 73 additions & 0 deletions osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,73 @@
# Copyright 2026 ResQ Software
# SPDX-License-Identifier: Apache-2.0
#
# OSV-Scanner configuration — scopes the commit/CI audit gate to what actually
# ships to consumers.
#
# Every package ignored below is a DEV / BUILD-tooling transitive dependency
# (Storybook → next/vite/esbuild/ws/@babel/core/markdown-it, markdownlint-cli →
# js-yaml/brace-expansion, posthog-js dev chain → dompurify). None is a runtime
# `dependencies` entry of any published `@resq-sw/*` package, so these advisories
# cannot reach consumers of the libraries.
#
# Verified 2026-06-13 via `bun why <pkg>` + a scan of every packages/*/package.json
# `dependencies` block (not devDependencies). The npm audit-ci pass (level=critical)
# already passes; this file brings the OSV pass in line with the same "production
# dependencies only" posture.
#
# Review periodically: when Storybook / the dev toolchain is upgraded, prune any
# entry whose advisories no longer appear so real future issues aren't masked.

[[PackageOverrides]]
name = "next"
ecosystem = "npm"
ignore = true
reason = "dev-only: pulled transitively by @storybook/nextjs-vite; not a runtime dep of any published package"

[[PackageOverrides]]
name = "vite"
ecosystem = "npm"
ignore = true
reason = "dev-only: Storybook / example-react-dashboard build tooling; not shipped"

[[PackageOverrides]]
name = "esbuild"
ecosystem = "npm"
ignore = true
reason = "dev-only: Storybook + vite build tooling; not shipped"

[[PackageOverrides]]
name = "ws"
ecosystem = "npm"
ignore = true
reason = "dev-only: storybook + @effect/platform-bun dev chain; not a runtime dep of any published package"

[[PackageOverrides]]
name = "@babel/core"
ecosystem = "npm"
ignore = true
reason = "dev-only: Storybook (@storybook/react, nextjs-vite) build tooling; not shipped"

[[PackageOverrides]]
name = "js-yaml"
ecosystem = "npm"
ignore = true
reason = "dev-only: markdownlint-cli + @changesets/cli tooling; not shipped"

[[PackageOverrides]]
name = "markdown-it"
ecosystem = "npm"
ignore = true
reason = "dev-only: Storybook docs tooling; not shipped"

[[PackageOverrides]]
name = "brace-expansion"
ecosystem = "npm"
ignore = true
reason = "dev-only: markdownlint-cli + @storybook/nextjs-vite tooling; not shipped"

Comment on lines +21 to +68

@gemini-code-assist gemini-code-assist Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

Ignoring entire packages globally by name using ignore = true in PackageOverrides introduces a significant security risk.

Risks:

  1. Unmonitored Future Vulnerabilities: Any new vulnerabilities (including critical RCEs or prototype pollutions) discovered in these packages in the future will be silently ignored and never reported.
  2. Production Promotion: If any of these packages (e.g., ws, js-yaml, or vite) are later added as direct or transitive production dependencies in any package or application within the monorepo, they will remain completely unmonitored.

Recommended Alternative:

Instead of ignoring the entire package, ignore only the specific vulnerability IDs (e.g., GHSA-... or CVE-...) currently affecting your dev dependencies using the [[Ignore]] block. This ensures that any new vulnerabilities in these packages will still be flagged.

[[Ignore]]
id = "GHSA-xxxx-xxxx-xxxx"
reason = "dev-only: pulled transitively by @storybook/nextjs-vite"

[[PackageOverrides]]
name = "dompurify"
ecosystem = "npm"
ignore = true
reason = "dev-only: pulled by posthog-js, a devDependency / optional peer of @resq-sw/analytics; not a runtime dep of any published package"
Comment on lines +70 to +73

@gemini-code-assist gemini-code-assist Bot Jun 17, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

security-high high

The assumption that dompurify is "dev-only" and "not shipped" is incorrect.

posthog-js is listed as a peerDependency in packages/analytics/package.json. When consumers use @resq-sw/analytics and install posthog-js, dompurify is pulled into their production runtime environment.

Since dompurify is used for HTML sanitization, vulnerabilities in it (such as XSS bypasses) directly impact the security of the applications consuming your library. Ignoring dompurify entirely prevents you from being alerted to critical security vulnerabilities that your consumers will run in production.

Loading