hanzoai/DOMPurify
2
0
Fork 0
mirror of https://github.com/hanzoai/DOMPurify.git synced 2026-09-24 16:55:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added osv-scanner.toml for the legacy Playwright (#1471)

Browse Source
This commit is contained in:
Cure53
2026-06-11 18:22:40 +02:00
committed by GitHub
parent eba6ab28fd
commit 83c269bbd8
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
test/legacy-playwright/osv-scanner.toml
+10
View File
@@ -0,0 +1,10 @@
# Why this is safe to ignore: dev-only legacy-browser harness, not shipped in the
# published npm package. The vulnerable `curl -k` scripts are the chrome/msedge
# stable-channel reinstall helpers, never hit by the chromium/firefox/webkit
# install path this harness uses; `npm ci` runs with --ignore-scripts; the runner
# is Linux while the flagged scripts are *_mac.sh. Those four conditions are
# load-bearing - if any of them changes, this ignore must be re-reviewed.
[[IgnoredVulns]]
id = "GHSA-7mvr-c777-76hp"
ignoreUntil = 2027-05-31
reason = "Dev-only legacy-browser harness, not in the published package; vulnerable curl -k mac reinstall scripts never invoked by the chromium/firefox/webkit install path; npm ci --ignore-scripts; Linux runner."