mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-10-25 21:20:25 +00:00
Anso
d30e4daadc
The braces advisory GHSA-vfj7-8cjw-p6xm (CVE-2026-93687) marks every released version (<= 3.0.3) HIGH for stack exhaustion while parsing a deeply nested glob pattern, and no patched release exists. braces reaches the production image through http-proxy-middleware -> micromatch, and dev tooling through chokidar, so both the Trivy image scan and the npm audit gate fail on every branch. Record the triage as an OpenVEX not_affected statement: the only patterns braces compiles come from static proxy and watcher configuration at startup, and request URLs are matched against the compiled matcher, never compiled as patterns, so an adversary cannot control the vulnerable code path. Verified against a real scan with `trivy fs --scanners vuln --vex`. Replace the two `npm audit --audit-level=high` CI steps with scripts/audit-with-vex.mjs, which fails only on advisories the VEX document does not cover and propagates suppression through npm's `via` dependency chains. The statement carries the CVE in `name` for Trivy and the GHSA URL in `@id` for the script, so one record suppresses both gates.