2022-04-21 23:58:57 +02:00
|
|
|
# improved-yarn-audit advisory exclusions
|
|
|
|
|
GHSA-257v-vj4p-3w2h
|
2022-12-08 17:38:04 +01:00
|
|
|
|
|
|
|
|
# yarn berry's `yarn npm audit` script reports the following vulnerability but
|
|
|
|
|
# it is a false positive. The offending version of 'ws' that is installed is
|
|
|
|
|
# 7.1.1 and is included only via remote-redux-devtools which is a devDependency
|
|
|
|
|
GHSA-6fc8-4gx4-v693
|
2023-01-04 18:29:37 +01:00
|
|
|
|
|
|
|
|
# yarn npm audit reports on a fast-json-patch version < 3.1.1 but due to patch
|
|
|
|
|
# resolution, the only version of fast-json-patch that we use is 3.1.1. We also
|
|
|
|
|
# have 2.2.1 installed but it is a dev only dependency. The "violation" reports
|
|
|
|
|
# smart-transacton-controller as the culprit but if you run
|
|
|
|
|
# `yarn info -A -R dependents fast-json-patch` you can see that only 2.2.1 and
|
|
|
|
|
# 3.3.1 are installed and that smart-transaction-controller resolves to the
|
|
|
|
|
# patched version of 3.3.1. We can remove this once the
|
|
|
|
|
# smart-transaction-controller updates its dependency.
|
|
|
|
|
GHSA-8gh8-hqwg-xf34
|
2023-03-17 15:29:39 +01:00
|
|
|
|
|
|
|
|
# request library is subject to SSRF.
|
|
|
|
|
# addressed by temporary patch in .yarn/patches/request-npm-2.88.2-f4a57c72c4.patch
|
|
|
|
|
GHSA-p8p7-x288-28g6
|
