mirror of
https://github.com/alsk1992/CloddsBot.git
synced 2026-10-02 02:54:40 +08:00
55 lines
2.7 KiB
JSON
55 lines
2.7 KiB
JSON
{
|
|
// audit-ci config — see .github/workflows/ci.yml and security.yml.
|
|
//
|
|
// Every advisory below is transitive through the Solana/crypto SDK ecosystem's own
|
|
// pinned old dependencies (@project-serum/anchor, @coral-xyz/anchor, @drift-labs/sdk,
|
|
// and friends depend on old @solana/web3.js/protobufjs/uuid/@grpc-js internally).
|
|
// None of these have a fix that doesn't mean either
|
|
// downgrading a currently-working trading integration or forcing a major bump whose
|
|
// breaking changes haven't been vetted (e.g. @drift-labs/sdk's suggested fix requires
|
|
// Node 24, a separate decision from a routine audit pass).
|
|
//
|
|
// Re-run `npm audit --audit-level=moderate --production` periodically — when an
|
|
// upstream SDK finally updates its own pinned deps, the corresponding entry below
|
|
// should come out of this list, not just get silently re-added by a future audit fix.
|
|
"moderate": true,
|
|
"production": true,
|
|
"allowlist": [
|
|
// @grpc/grpc-js — via @drift-labs/sdk. Fix requires @drift-labs/sdk@2.141.0, a
|
|
// semver-major bump needing Node >=24 (this repo targets Node 22) — not a safe
|
|
// drop-in for a live trading integration verified working this session.
|
|
"GHSA-5375-pq7m-f5r2",
|
|
"GHSA-99f4-grh7-6pcq",
|
|
|
|
// protobufjs / protobuf.js — transitive through @project-serum/anchor and the
|
|
// wider Solana SDK tree (Orca, Kamino, Raydium's own transitive deps, etc.), all
|
|
// of which pin old @solana/web3.js internally. No fix without forcing a
|
|
// semver-major on packages this session verified are live and working.
|
|
"GHSA-xq3m-2v4x-88gg",
|
|
"GHSA-66ff-xgx4-vchm",
|
|
"GHSA-2pr8-phx7-x9h3",
|
|
"GHSA-fx83-v9x8-x52w",
|
|
"GHSA-75px-5xx7-5xc7",
|
|
"GHSA-jvwf-75h9-cwgg",
|
|
"GHSA-685m-2w69-288q",
|
|
"GHSA-q6x5-8v7m-xcrf",
|
|
"GHSA-jggg-4jg4-v7c6",
|
|
"GHSA-wcpc-wj8m-hjx6",
|
|
"GHSA-f38q-mgvj-vph7",
|
|
|
|
// uuid — v3/v5/v6 buffer-bounds check (the v4 generator is unaffected). Verified
|
|
// node-cron's own source only calls uuid.v4() (scheduled-task.js, storage.js).
|
|
// The other path, @wormhole-foundation/sdk-solana's pinned rpc-websockets, has no
|
|
// direct `uuid` reference in its own source at all — likely unused/indirect — but
|
|
// that's not fully confirmed, so treat this allowlist entry as provisional pending
|
|
// a closer look, not as verified-safe the way node-cron's path is.
|
|
"GHSA-w5hq-g745-h8pq",
|
|
|
|
// stream-json — quadratic behavior is confined to the pick/ignore/filter/replace
|
|
// helpers. The only production consumer is jayson, which imports StreamValues and
|
|
// Verifier instead. jayson 4.3 pins stream-json 1.x and is incompatible with the
|
|
// patched 3.x module paths, so forcing the major would break Solana RPC parsing.
|
|
"GHSA-528h-pc64-c93x"
|
|
]
|
|
}
|