oadmin/sub2api
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

chore: add lodash/lodash-es audit exception for GHSA-r5fr-rjxr-66jc

Browse Source
This commit is contained in:
erio
2026-04-03 01:53:17 +08:00
parent 66fde7a2e6
commit ff6d4ab39a
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
.github/audit-exceptions.yml vendored
View File

@@ -14,3 +14,17 @@ exceptions:
mitigation: "Load only on export; restrict export permissions and data scope"
expires_on: "2026-04-05"
owner: "security@your-domain"
- package: lodash
advisory: "GHSA-r5fr-rjxr-66jc"
severity: high
reason: "lodash _.template not used with untrusted input; only internal admin UI templates"
mitigation: "No user-controlled template strings; plan to migrate to lodash-es tree-shaken imports"
expires_on: "2026-07-02"
owner: "security@your-domain"
- package: lodash-es
advisory: "GHSA-r5fr-rjxr-66jc"
severity: high
reason: "lodash-es _.template not used with untrusted input; only internal admin UI templates"
mitigation: "No user-controlled template strings; plan to migrate to native JS alternatives"
expires_on: "2026-07-02"
owner: "security@your-domain"