mirror of
https://github.com/hanzoai/DOMPurify.git
synced 2026-09-24 16:55:05 +00:00
11 lines
754 B
TOML
11 lines
754 B
TOML
# Why this is safe to ignore: dev-only legacy-browser harness, not shipped in the
|
|
# published npm package. The vulnerable `curl -k` scripts are the chrome/msedge
|
|
# stable-channel reinstall helpers, never hit by the chromium/firefox/webkit
|
|
# install path this harness uses; `npm ci` runs with --ignore-scripts; the runner
|
|
# is Linux while the flagged scripts are *_mac.sh. Those four conditions are
|
|
# load-bearing - if any of them changes, this ignore must be re-reviewed.
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-7mvr-c777-76hp"
|
|
ignoreUntil = 2027-05-31
|
|
reason = "Dev-only legacy-browser harness, not in the published package; vulnerable curl -k mac reinstall scripts never invoked by the chromium/firefox/webkit install path; npm ci --ignore-scripts; Linux runner."
|