Skip to content

Audit/2026 04 29 #376

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
jasonmorais wants to merge 2 commits into
base: jason.weekly-audit-pipeline
Choose a base branch
from
+238 −74
Draft

Audit/2026 04 29 #376

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
20a4e40
docs: add baseline weekly audit 2026-04-29
jasonmorais Apr 29, 2026
bac065d
docs: add weekly audit 2026-04-29 (baseline)
jasonmorais Apr 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
74 changes: 0 additions & 74 deletions .snyk
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,80 +10,6 @@ ignore:
reason: 'Transitive dependency in Docusaurus; upgrade path blocked until upstream deps are updated. Not exploitable in current usage.'
expires: '2026-03-07T00:00:00.000Z'
created: '2025-12-05T00:00:00.000Z'
'SNYK-JS-NODEFORGE-14114940':
- '* > node-forge':
reason: 'Transitive dependency in Docusaurus; not exploitable in current usage.'
expires: '2026-03-15T00:00:00.000Z'
created: '2025-12-05T00:00:00.000Z'
'SNYK-JS-EXPRESS-14157151':
- '@docusaurus/core@3.9.2 > * > express':
reason: 'Transitive dependency in Docusaurus; not exploitable in current usage.'
expires: '2026-03-16T00:00:00.000Z'
created: '2025-12-05T00:00:00.000Z'
- '@docusaurus/plugin-content-docs@3.9.2 > * > express':
reason: 'Transitive dependency in Docusaurus; not exploitable in current usage.'
expires: '2026-03-16T00:00:00.000Z'
created: '2025-12-05T00:00:00.000Z'
- '@docusaurus/preset-classic@3.9.2 > * > express':
reason: 'Transitive dependency in Docusaurus; not exploitable in current usage.'
expires: '2026-03-16T00:00:00.000Z'
created: '2025-12-05T00:00:00.000Z'
'SNYK-JS-PNPMNPMCONF-14897556':
- '* > @pnpm/npm-conf@2.3.1':
reason: 'Transitive dependency in Docusaurus; not exploitable in static site serving context'
expires: '2026-06-01T00:00:00.000Z'
created: '2026-01-20T00:00:00.000Z'
'SNYK-JS-UNDICI-14943963':
- '* > undici@5.29.0':
reason: 'Transitive dependency in Azure Functions and payment services; upgrade blocked by upstream compatibility'
expires: '2026-06-01T00:00:00.000Z'
created: '2026-01-20T00:00:00.000Z'
'SNYK-JS-QS-14724253':
- '* > qs@6.13.0':
reason: 'Transitive dependency in various packages (azurite, express); not exploitable in current usage context'
expires: '2026-06-01T00:00:00.000Z'
created: '2026-01-21T00:00:00.000Z'

- '* > qs':
reason: 'Transitive dependency in express, @docusaurus/core, @apollo/server, apollo-link-rest; not exploitable in current usage.'
expires: '2026-01-19T00:00:00.000Z'
created: '2026-01-05T09:39:00.000Z'
'SNYK-JS-AJV-15274295':
- '* > ajv@8.17.1':
reason: 'Transitive dependency in Docusaurus; ReDoS vulnerability not exploitable in static site generation context'
expires: '2026-08-13T00:00:00.000Z'
created: '2026-02-13T00:00:00.000Z'
- '* > ajv@6.12.6':
reason: 'Transitive dependency in Docusaurus; ReDoS vulnerability not exploitable in static site generation context'
expires: '2026-08-13T00:00:00.000Z'
created: '2026-02-13T00:00:00.000Z'

'SNYK-JS-MINIMATCH-15309438':
- '* > minimatch@3.1.2':
reason: 'Transitive dependency in Docusaurus; not exploitable in current usage context'
expires: '2026-03-13T00:00:00.000Z'
created: '2026-02-13T00:00:00.000Z'

'SNYK-JS-YAUZL-15467445':
- '* > yauzl@3.2.0':
reason: 'Off-by-one Error in yauzl; no upgrade path available without major mongodb-memory-server version change. Only used in acceptance tests for MongoDB in-memory server testing, not production code.'
expires: '2026-06-12T00:00:00.000Z'
created: '2026-03-12T00:00:00.000Z'

'SNYK-JS-SVGO-15423912':
- '@docusaurus/preset-classic@3.9.2 > * > svgo@3.3.2':
reason: 'XML Entity Expansion in svgo; transitive dependency in Docusaurus documentation package (dev-only). SVG files processed by Docusaurus are from trusted sources during build time, not user input. Snyk reports no direct upgrade path due to pinned versions in @svgr/plugin-svgo.'
expires: '2026-09-12T00:00:00.000Z'
created: '2026-03-12T00:00:00.000Z'
- '@docusaurus/plugin-svgr@3.9.2 > * > svgo@3.3.2':
reason: 'XML Entity Expansion in svgo; transitive dependency in Docusaurus documentation package (dev-only). SVG files processed by Docusaurus are from trusted sources during build time, not user input. Snyk reports no direct upgrade path due to pinned versions in @svgr/plugin-svgo.'
expires: '2026-09-12T00:00:00.000Z'
created: '2026-03-12T00:00:00.000Z'
- '* > svgo@3.3.2':
reason: 'XML Entity Expansion in svgo; transitive dependency in Docusaurus documentation package (dev-only). SVG files processed by Docusaurus are from trusted sources during build time, not user input. Snyk reports no direct upgrade path due to pinned versions in @svgr/plugin-svgo.'
expires: '2026-09-12T00:00:00.000Z'
created: '2026-03-12T00:00:00.000Z'

'SNYK-JS-LODASH-15869619':
- '* > lodash@4.17.23':
reason: 'No fixed version is available for lodash. The remaining occurrences are in Docusaurus, CyberSource/node-jose, and a UI import that only uses lodash/merge; the vulnerable omit, unset, and template APIs are not used in this repo.'
Expand Down
Loading
Loading