diff --git a/.circleci/config.yml b/.circleci/config.yml index c631070a1..6b9df3b8d 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -119,7 +119,8 @@ jobs: echo "🔍 Running bun audit for security vulnerabilities..." echo "Checking for HIGH-RISK vulnerabilities..." - if bun audit --audit-level high; then + # Ignore CVE-2025-64756 (aka GHSA-5j98-mcp5-4vw2) - glob is not used on the command line + if bun audit --ignore=GHSA-5j98-mcp5-4vw2 --audit-level high; then echo "✅ No high-risk vulnerabilities found" echo "🎉 Security audit passed!" else @@ -135,7 +136,10 @@ jobs: echo " 5. Re-run: bun audit --audit-level high" echo "" echo "📋 Full audit report:" - bun audit --audit-level low || true + + # Ignore CVE-2025-64756 (aka GHSA-5j98-mcp5-4vw2) - glob is not used on the command line + bun audit --ignore=GHSA-5j98-mcp5-4vw2 --audit-level low || true + echo "" echo "❌ This build cannot proceed until high-risk vulnerabilities are resolved." exit 1 diff --git a/package.json b/package.json index f60aa0a0f..04e71e07c 100644 --- a/package.json +++ b/package.json @@ -48,7 +48,7 @@ "install:dev": "cp -f yarn.lock addOns/yarn.lock && cd addOns && yarn install --frozen-lockfile --modules-folder ../node_modules", "install:update-lockfile": "yarn install && bun install --config=./bunfig.update-lockfile.toml", "install:yarn:frozen-lockfile": "yarn install --frozen-lockfile", - "audit": "yarn audit || bun audit", + "audit": "bun audit --ignore=GHSA-5j98-mcp5-4vw2", "preinstall": "node preinstall.js", "start": "yarn run dev", "test": "yarn run test:unit", diff --git a/platform/docs/package.json b/platform/docs/package.json index 09c1b0f41..68d48ec4e 100644 --- a/platform/docs/package.json +++ b/platform/docs/package.json @@ -76,7 +76,7 @@ "docusaurus-plugin-image-zoom": "1.0.1", "file-loader": "6.2.0", "framer-motion": "6.2.4", - "glob": "10.4.5", + "glob": "10.5.0", "lucide-react": "0.379.0", "next-themes": "0.3.0", "postcss": "8.5.6", diff --git a/platform/docs/yarn.lock b/platform/docs/yarn.lock index 9b232098d..372b8a191 100644 --- a/platform/docs/yarn.lock +++ b/platform/docs/yarn.lock @@ -6535,10 +6535,10 @@ glob-to-regexp@^0.4.1: resolved "https://registry.yarnpkg.com/glob-to-regexp/-/glob-to-regexp-0.4.1.tgz#c75297087c851b9a578bd217dd59a92f59fe546e" integrity sha512-lkX1HJXwyMcprw/5YUZc2s7DrpAiHB21/V+E1rHUrVNokkvB6bqMzT0VfV6/86ZNabt1k14YOIaT7nDvOX3Iiw== -glob@10.4.5, glob@^10.3.10: - version "10.4.5" - resolved "https://registry.yarnpkg.com/glob/-/glob-10.4.5.tgz#f4d9f0b90ffdbab09c9d77f5f29b4262517b0956" - integrity sha512-7Bv8RF0k6xjo7d4A/PxYLbUCfb6c+Vpd2/mB2yRDlew7Jb5hEXiCD9ibfO7wpk8i4sevK6DFny9h7EYbM3/sHg== +glob@10.5.0, glob@^10.3.10: + version "10.5.0" + resolved "https://registry.yarnpkg.com/glob/-/glob-10.5.0.tgz#8ec0355919cd3338c28428a23d4f24ecc5fe738c" + integrity sha512-DfXN8DfhJ7NH3Oe7cFmu3NCu1wKbkReJ8TorzSAFbSKrlNaQSKfIzqYqVY8zlbs2NLBbWpRiU52GX2PbaBVNkg== dependencies: foreground-child "^3.1.0" jackspeak "^3.1.2"