chore(security and testing): patch sigstore and run Playwright CI on the nashua self-hosted runner for release/3.12 (#6123)

2026-07-07 13:53:57 -04:00
1 parent 8460409a62
commit 646dd583a2
@@ -137,6 +137,7 @@ jobs:
              "GHSA-7r86-cg39-jmmj"  # CVE-2026-27903 - minimatch same as above
              "GHSA-23c5-xmqv-rm74"  # CVE-2026-27904 - minimatch same as above
              "GHSA-c2c7-rcm5-vvqj"  # CVE-2026-33671 - picomatch is generally used for development and CI/CD purposes
+              "GHSA-mp2f-45pm-3cg9"  # CVE-2026-53486 - decompress is called only ever decompresses a hash-pinned, hardcoded archive in a dev-only CLI
            )

            # Build ignore flags