othmane/ohif-viewer
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(security): Ignore CVE-2026-23745, CVE-2026-23950 and CVE-2024-28863 because they are limited to build/dev environments. (#5733)

Browse Source 
The tar vulnerabilities affect build-time tools (lerna) and transitive dependencies, but not runtime data flow from Cornerstone3D to its dependencies.
This commit is contained in:
Joe Boccanfuso 2026-01-21 13:02:40 -05:00 committed by GitHub
parent 16267d9ddd
commit 320f0a7463
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 15 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
.circleci/config.yml
View File

@ -119,8 +119,20 @@ jobs:
echo "🔍 Running bun audit for security vulnerabilities..."
echo "Checking for HIGH-RISK vulnerabilities..."
# Ignore CVE-2025-64756 (aka GHSA-5j98-mcp5-4vw2) - glob is not used on the command line
if bun audit --ignore=GHSA-5j98-mcp5-4vw2 --audit-level high; then
# Define ignored vulnerabilities with comments
IGNORED_VULNS=(
"GHSA-5j98-mcp5-4vw2" # CVE-2025-64756 - glob is not used on the command line
"GHSA-8qq5-rm4j-mr97" # CVE-2026-23745 - limited to build/dev environments
"GHSA-r6q2-hw4h-h46w" # CVE-2026-23950 - limited to build/dev environments
)
# Build ignore flags
IGNORE_FLAGS=""
for vuln in "${IGNORED_VULNS[@]}"; do
IGNORE_FLAGS="$IGNORE_FLAGS --ignore=$vuln"
done
if bun audit $IGNORE_FLAGS --audit-level high; then
echo "✅ No high-risk vulnerabilities found"
echo "🎉 Security audit passed!"
else
@ -137,8 +149,7 @@ jobs:
echo ""
echo "📋 Full audit report:"
# Ignore CVE-2025-64756 (aka GHSA-5j98-mcp5-4vw2) - glob is not used on the command line
bun audit --ignore=GHSA-5j98-mcp5-4vw2 --audit-level low || true
bun audit $IGNORE_FLAGS --audit-level low || true
echo ""
echo "❌ This build cannot proceed until high-risk vulnerabilities are resolved."