audit-exceptions.json

{
  "exceptions": [
    {
      "advisoryId": 1120743,
      "package": "form-data",
      "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx",
      "reason": "CRLF injection in form-data occurs only when unescaped filenames are manipulated via the client library. In our app, form-data is a transitive dev dependency for testing/Storybook, and the production upload route utilizes Next.js built-in req.formData() parsing, which is safe."
    },
    {
      "advisoryId": 1113686,
      "package": "serialize-javascript",
      "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
      "reason": "Remote Code Execution in serialize-javascript. This package is transitively used by rollup-plugin-terser inside workbox-build for PWA generation at build time, never in production runtime or dynamic server contexts."
    },
    {
      "advisoryId": 1120789,
      "package": "vite",
      "url": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
      "reason": "Vite server.fs.deny bypass only affects dev servers running on Windows platforms. Our production runtime is deployed under Linux container environments running Next.js."
    },
    {
      "package": "brace-expansion",
      "url": "https://github.com/advisories/GHSA-3jxr-9vmj-r5cp",
      "reason": "DoS via brace-expansion is a transitive tooling dependency (lint/test). Not reachable from production request paths."
    },
    {
      "package": "glob",
      "url": "https://github.com/advisories/GHSA-5j98-mcp5-4vw2",
      "reason": "glob CLI command injection requires invoking the glob CLI with -c/--cmd. App does not shell out to glob CLI in production."
    },
    {
      "package": "next",
      "url": "https://github.com/advisories/GHSA-m99w-x7hq-7vfj",
      "reason": "Tracked Next.js App Router DoS advisory; mitigated by staying on the maintained 15.5.x line and not exposing untrusted Server Action payloads publicly. Upgrade planned with next patch train."
    },
    {
      "package": "next",
      "url": "https://github.com/advisories/GHSA-89xv-2m56-2m9x",
      "reason": "Server Actions SSRF on custom servers; Kora is deployed on standard Next hosting without custom server Action proxying."
    },
    {
      "package": "next",
      "url": "https://github.com/advisories/GHSA-p9j2-gv94-2wf4",
      "reason": "Rewrite SSRF requires attacker-controlled rewrite destinations; our next.config rewrites are static."
    },
    {
      "package": "picomatch",
      "url": "https://github.com/advisories/GHSA-c2c7-rcm5-vvqj",
      "reason": "ReDoS in picomatch affects build/dev tooling (vite/webpack); not exposed on production request paths."
    },
    {
      "package": "postcss",
      "url": "https://github.com/advisories/GHSA-6g55-p6wh-862q",
      "reason": "PostCSS sourceMappingURL issue is a build-time CSS tooling concern; production serves compiled CSS without processing attacker CSS comments."
    },
    {
      "package": "sharp",
      "url": "https://github.com/advisories/GHSA-f88m-g3jw-g9cj",
      "reason": "sharp/libvips CVEs are transitive via Next image optimization; no untrusted image pipelines beyond configured remotePatterns."
    },
    {
      "package": "sigstore",
      "url": "https://github.com/advisories/GHSA-52v5-jr5w-gjxr",
      "reason": "sigstore is a release/CI signing transitive dependency, not used in the runtime app bundle."
    },
    {
      "package": "tar",
      "url": "https://github.com/advisories/GHSA-23hp-3jrh-7fpw",
      "reason": "tar DoS is a transitive install/build dependency; production does not unpack untrusted tar archives."
    },
    {
      "package": "tar",
      "url": "https://github.com/advisories/GHSA-8x88-c5mf-7j5w",
      "reason": "tar infinite-loop advisory is a transitive install/build dependency; production does not unpack untrusted tar archives."
    },
    {
      "package": "tmp",
      "url": "https://github.com/advisories/GHSA-ph9p-34f9-6g65",
      "reason": "tmp path traversal is a transitive tooling dependency; not used with attacker-controlled prefixes in production."
    },
    {
      "package": "axios",
      "url": "https://github.com/advisories/GHSA-8w2h-qw4j-3x6q",
      "reason": "Axios advisories are accepted transitively; Pinata/HTTP calls use trusted gateways and do not pass attacker-controlled absolute URLs or proxy config."
    },
    {
      "package": "axios",
      "reason": "Bundle axios high/critical advisories as a known transitive risk pending upgrade; app uses axios only against configured Pinata/API endpoints."
    },
    {
      "package": "js-yaml",
      "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj",
      "reason": "js-yaml !!omap CPU advisory is transitive via lint/test tooling; production does not parse untrusted YAML."
    },
    {
      "package": "nanoid",
      "reason": "nanoid generator-loop advisories are transitive via tooling; app does not call non-secure generators with attacker-controlled sizes."
    },
    {
      "package": "vitest",
      "reason": "Vitest UI arbitrary-file advisory only applies when the Vitest UI server is listening; CI runs vitest in headless CLI mode and it is not shipped to production."
    }
  ]
}