From 97d15feb8b161cc2f63dbfc0c185d0722e5c25a0 Mon Sep 17 00:00:00 2001 From: Jan Cizmar Date: Thu, 11 Jun 2026 14:08:59 +0200 Subject: [PATCH] chore: add Snyk ignore policy for accepted/unfixable advisories Document risk-acceptance for the advisories left after the dependency patches, none of which carry meaningful real-world risk: - webapp/.snyk: zxcvbn, inflight, d3-color - browser-side issues whose input crosses no trust boundary, with no clean upstream fix - e2e/.snyk: xlsx (ReDoS + prototype pollution) - test-only Cypress harness, never shipped, no npm fix (SheetJS ships fixes via CDN only) Each entry carries a justification and a one-year expiry for re-review. Verified locally: `snyk test` reports the listed advisories as ignored. --- e2e/.snyk | 21 +++++++++++++++++++++ webapp/.snyk | 31 +++++++++++++++++++++++++++++++ 2 files changed, 52 insertions(+) create mode 100644 e2e/.snyk create mode 100644 webapp/.snyk diff --git a/e2e/.snyk b/e2e/.snyk new file mode 100644 index 0000000000..6d7838b568 --- /dev/null +++ b/e2e/.snyk @@ -0,0 +1,21 @@ +# Snyk (https://snyk.io) policy file. +# These advisories live in the Cypress e2e test harness only. The code never +# ships to users and never runs in production — it executes in CI against known +# fixture files, not attacker-controlled input. xlsx (SheetJS) has no published +# npm fix. Re-review on expiry. +version: v1.25.0 +ignore: + SNYK-JS-XLSX-6252523: + - '*': + reason: >- + ReDoS in xlsx. Test-only dependency (Cypress e2e); never shipped, + never processes untrusted input. No npm fix available (SheetJS + distributes fixes via their own CDN only). + expires: 2027-06-11T00:00:00.000Z + SNYK-JS-XLSX-5457926: + - '*': + reason: >- + Prototype pollution in xlsx. Test-only dependency (Cypress e2e); never + shipped, never processes untrusted input. No npm fix available + (SheetJS distributes fixes via their own CDN only). + expires: 2027-06-11T00:00:00.000Z diff --git a/webapp/.snyk b/webapp/.snyk new file mode 100644 index 0000000000..d59ef9fe73 --- /dev/null +++ b/webapp/.snyk @@ -0,0 +1,31 @@ +# Snyk (https://snyk.io) policy file. +# Documented risk-acceptances for advisories with no clean upstream fix. These +# are browser-side issues whose only input crosses no trust boundary, so the +# real-world impact is negligible. Re-review on expiry. +version: v1.25.0 +ignore: + SNYK-JS-ZXCVBN-3257741: + - '*': + reason: >- + ReDoS in the client-side password-strength estimator. The only input + is the user's own password as they type it, so the worst case is a + user slowing down their own browser tab. No cross-user or server + impact. zxcvbn is unmaintained with no patched release; migrating to + @zxcvbn-ts/core is tracked as separate tech-debt. + expires: 2027-06-11T00:00:00.000Z + SNYK-JS-INFLIGHT-6095116: + - '*': + reason: >- + Memory leak in a deprecated package reached only via + react-query > broadcast-channel > rimraf > glob, a Node-only + leader-election path that is not exercised in the browser bundle. No + upstream fix exists (package is deprecated). + expires: 2027-06-11T00:00:00.000Z + SNYK-JS-D3COLOR-1076592: + - '*': + reason: >- + ReDoS in d3-color via recharts. The parsed color strings come from the + app's own chart configuration, not attacker-controlled input. The fix + requires a major d3 bump that risks breaking recharts; deferred as + low-risk. + expires: 2027-06-11T00:00:00.000Z