From 6527b3c3fa9a85803dc4963b3ebe5e34225bad42 Mon Sep 17 00:00:00 2001 From: Merlin Beutlberger Date: Wed, 21 Oct 2026 16:44:31 +0200 Subject: [PATCH] ci: Update audit-ci allowlist, ignore new launch-editor findings Not applicable in our project --- audit-ci.jsonc | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/audit-ci.jsonc b/audit-ci.jsonc index 2e54940a109..6d6f58d6852 100644 --- a/audit-ci.jsonc +++ b/audit-ci.jsonc @@ -30,9 +30,11 @@ // No fix available for Vite 5.x; patches exist only for Vite >= 6.4.3. "GHSA-fx2h-pf6j-xcff|vitepress>vite", - // GHSA-v6wh-96g9-6wx3: launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows // Not applicable as we don't use launch-editor. "GHSA-v6wh-96g9-6wx3|vitepress>vite", + "GHSA-587h-7wmj-h5pm|vitepress>vite", + "GHSA-698v-4r3x-3vcv|vitepress>vite", + "GHSA-r825-w8mm-5pxw|vitepress>vite", // AI slop CVEs (not applicable) - See dependabot alert dismissals for details "GHSA-hp3w-g68c-fv3c|@istanbuljs/esm-loader-hook>@istanbuljs/load-nyc-config>js-yaml>argparse>sprintf-js",