From 333d73e334f1fcf466947cf6a0f6b1821d6c038e Mon Sep 17 00:00:00 2001
From: Joe Boccanfuso <109477394+jbocce@users.noreply.github.com>
Date: Tue, 7 Jul 2026 19:58:15 +0200
Subject: [PATCH] fix(security): ignore decompress security vulnerability
 (#6125)

---
 pnpm-workspace.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/pnpm-workspace.yaml b/pnpm-workspace.yaml
index 119f3ed34..5c4f4c910 100644
--- a/pnpm-workspace.yaml
+++ b/pnpm-workspace.yaml
@@ -24,7 +24,8 @@ verifyDepsBeforeRun: false
 # fed user-supplied expressions. Kept in sync with the .circleci SECURITY_AUDIT
 # job and the root `audit` script.
 auditConfig:
-  ignoreGhsas: []
+  ignoreGhsas:
+    - GHSA-mp2f-45pm-3cg9 # decompress is called only ever decompresses a hash-pinned, hardcoded archive in a dev-only CLI
 
 allowBuilds:
   '@scarf/scarf': true