chore: add Snyk ignore policy for accepted/unfixable advisories - #3746
Conversation
Document risk-acceptance for the advisories left after the dependency patches, none of which carry meaningful real-world risk: - webapp/.snyk: zxcvbn, inflight, d3-color - browser-side issues whose input crosses no trust boundary, with no clean upstream fix - e2e/.snyk: xlsx (ReDoS + prototype pollution) - test-only Cypress harness, never shipped, no npm fix (SheetJS ships fixes via CDN only) Each entry carries a justification and a one-year expiry for re-review. Verified locally: `snyk test` reports the listed advisories as ignored.
📝 WalkthroughWalkthroughThis PR updates Snyk security policy files in two locations to version v1.25.0, documenting accepted vulnerabilities with explanatory rationale and consistent expiration dates. The e2e directory accepts XLSX-related risks in the Cypress harness, while the webapp directory accepts vulnerabilities in three JavaScript dependencies. All acceptances expire on 2027-06-11. ChangesSnyk Advisory Acceptance
🎯 1 (Trivial) | ⏱️ ~2 minutes
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@e2e/.snyk`:
- Line 6: Update the Snyk policy schema version string in the .snyk file by
changing the declared value from "version: v1.25.0" to "version: v1.25.1" so the
policy aligns with the current Snyk schema; locate the line containing the
version key and replace the old version literal with the new one.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 31baeedb-2868-4545-a120-e28b45916c7c
📒 Files selected for processing (2)
e2e/.snykwebapp/.snyk
| # ships to users and never runs in production — it executes in CI against known | ||
| # fixture files, not attacker-controlled input. xlsx (SheetJS) has no published | ||
| # npm fix. Re-review on expiry. | ||
| version: v1.25.0 |
There was a problem hiding this comment.
🧩 Analysis chain
🌐 Web query:
What is the current valid Snyk policy file version format and latest version number?
💡 Result:
The current valid Snyk policy file format uses the YAML language [1]. The latest version number for the Snyk policy file schema is v1.25.1 [1][2][3]. While some official documentation pages may still reference v1.25.0 [4][5][6], active repositories maintained by Snyk, such as the official Snyk CLI repository, currently utilize v1.25.1 as the standard schema version [2][3]. The.snyk policy file is used to define analysis behaviors, including: - Ignore rules for vulnerabilities [4][7][1]. - Patch applications [1][2][3]. - Exclude rules for Snyk Code [1][2][3]. The file should start with the version definition, for example: version: v1.25.1 It is important to note that the policy schema version is distinct from the version of the snyk-policy package used to manage these files [4][5][6].
Citations:
- 1: https://deepwiki.com/snyk/cli/6-policy-management
- 2: https://github.com/snyk/cli/blob/main/.snyk
- 3: https://github.com/snyk/snyk-api-import/blob/master/.snyk
- 4: https://docs.snyk.io/scan-fix-and-prevent/prevent/policies/the-.snyk-file.md
- 5: https://docs.snyk.io/scan-fix-and-prevent/prevent/policies/the-.snyk-file
- 6: https://github.com/snyk/user-docs/blob/main/docs/manage-risk/policies/the-.snyk-file.md
- 7: https://docs.snyk.io/developer-tools/snyk-cli/snyk-cli/scan-and-maintain-projects-using-the-cli/snyk-cli-for-iac/iac-ignores-using-the-.snyk-policy-file
Align .snyk policy schema version with current schema (v1.25.1)
e2e/.snyk declares version: v1.25.0; Snyk’s current .snyk policy file schema version is v1.25.1, so update to version: v1.25.1 to match the latest supported/standard format.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@e2e/.snyk` at line 6, Update the Snyk policy schema version string in the
.snyk file by changing the declared value from "version: v1.25.0" to "version:
v1.25.1" so the policy aligns with the current Snyk schema; locate the line
containing the version key and replace the old version literal with the new one.
2 participants
Documents risk-acceptance for the advisories that remain after the dependency-fix PRs (#3742, #3743, #3744, #3745). None of these have a clean upstream fix, and none carry meaningful real-world risk — so rather than leave them flagged as open alerts (drowning out future real findings), they're explicitly accepted with a justification and a re-review expiry.
webapp/.snyk— browser-side, input crosses no trust boundarySNYK-JS-ZXCVBN-3257741SNYK-JS-INFLIGHT-6095116broadcast-channel → rimraf → globpath not exercised in the browser bundle. Deprecated, no fix.SNYK-JS-D3COLOR-1076592e2e/.snyk— test-only Cypress harnessSNYK-JS-XLSX-6252523SNYK-JS-XLSX-5457926Each entry has a one-year
expiresso they resurface for re-review. Verified locally —snyk testinwebapp/ande2e/reports these as ignored (e2e is now clean).Follow-up tech-debt (not security): migrate
zxcvbn→ the maintained@zxcvbn-ts/corefork.Summary by CodeRabbit