Skip to content

chore: add Snyk ignore policy for accepted/unfixable advisories #3746

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dkrizan merged 1 commit into from
Jun 11, 2026
Merged

chore: add Snyk ignore policy for accepted/unfixable advisories #3746

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 21 additions & 0 deletions e2e/.snyk
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,21 @@
# Snyk (https://snyk.io) policy file.
# These advisories live in the Cypress e2e test harness only. The code never
# ships to users and never runs in production — it executes in CI against known
# fixture files, not attacker-controlled input. xlsx (SheetJS) has no published
# npm fix. Re-review on expiry.
version: v1.25.0

@coderabbitai coderabbitai Bot Jun 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🌐 Web query:

What is the current valid Snyk policy file version format and latest version number?

💡 Result:

The current valid Snyk policy file format uses the YAML language [1]. The latest version number for the Snyk policy file schema is v1.25.1 [1][2][3]. While some official documentation pages may still reference v1.25.0 [4][5][6], active repositories maintained by Snyk, such as the official Snyk CLI repository, currently utilize v1.25.1 as the standard schema version [2][3]. The.snyk policy file is used to define analysis behaviors, including: - Ignore rules for vulnerabilities [4][7][1]. - Patch applications [1][2][3]. - Exclude rules for Snyk Code [1][2][3]. The file should start with the version definition, for example: version: v1.25.1 It is important to note that the policy schema version is distinct from the version of the snyk-policy package used to manage these files [4][5][6].

Citations:

Align .snyk policy schema version with current schema (v1.25.1)

e2e/.snyk declares version: v1.25.0; Snyk’s current .snyk policy file schema version is v1.25.1, so update to version: v1.25.1 to match the latest supported/standard format.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@e2e/.snyk` at line 6, Update the Snyk policy schema version string in the
.snyk file by changing the declared value from "version: v1.25.0" to "version:
v1.25.1" so the policy aligns with the current Snyk schema; locate the line
containing the version key and replace the old version literal with the new one.

ignore:
SNYK-JS-XLSX-6252523:
- '*':
reason: >-
ReDoS in xlsx. Test-only dependency (Cypress e2e); never shipped,
never processes untrusted input. No npm fix available (SheetJS
distributes fixes via their own CDN only).
expires: 2027-06-11T00:00:00.000Z
SNYK-JS-XLSX-5457926:
- '*':
reason: >-
Prototype pollution in xlsx. Test-only dependency (Cypress e2e); never
shipped, never processes untrusted input. No npm fix available
(SheetJS distributes fixes via their own CDN only).
expires: 2027-06-11T00:00:00.000Z
31 changes: 31 additions & 0 deletions webapp/.snyk
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
# Snyk (https://snyk.io) policy file.
# Documented risk-acceptances for advisories with no clean upstream fix. These
# are browser-side issues whose only input crosses no trust boundary, so the
# real-world impact is negligible. Re-review on expiry.
version: v1.25.0
ignore:
SNYK-JS-ZXCVBN-3257741:
- '*':
reason: >-
ReDoS in the client-side password-strength estimator. The only input
is the user's own password as they type it, so the worst case is a
user slowing down their own browser tab. No cross-user or server
impact. zxcvbn is unmaintained with no patched release; migrating to
@zxcvbn-ts/core is tracked as separate tech-debt.
expires: 2027-06-11T00:00:00.000Z
SNYK-JS-INFLIGHT-6095116:
- '*':
reason: >-
Memory leak in a deprecated package reached only via
react-query > broadcast-channel > rimraf > glob, a Node-only
leader-election path that is not exercised in the browser bundle. No
upstream fix exists (package is deprecated).
expires: 2027-06-11T00:00:00.000Z
SNYK-JS-D3COLOR-1076592:
- '*':
reason: >-
ReDoS in d3-color via recharts. The parsed color strings come from the
app's own chart configuration, not attacker-controlled input. The fix
requires a major d3 bump that risks breaking recharts; deferred as
low-risk.
expires: 2027-06-11T00:00:00.000Z
Loading