From 0c51857c161e24af2a8cd453ef9a4b705cf675a0 Mon Sep 17 00:00:00 2001 From: Merlin Beutlberger Date: Tue, 13 Oct 2026 15:40:02 +0200 Subject: [PATCH] ci: Ignore invalid and unpatchable CVEs Several recently reported CVEs are invalid according to the respective maintainers. No patches are available and no immediate risk for our usage, therefore ignoring the audit findings. --- audit-ci.jsonc | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/audit-ci.jsonc b/audit-ci.jsonc index d07dd7024df..cb8a49897bf 100644 --- a/audit-ci.jsonc +++ b/audit-ci.jsonc @@ -30,6 +30,16 @@ "GHSA-4mjr-xmp4-gh2g|@ui5/cli>@ui5/server>express>qs", "GHSA-4mjr-xmp4-gh2g|body-parser>qs", "GHSA-x5fp-wj9c-mxmx|@ui5/cli>@ui5/server>express>qs", - "GHSA-x5fp-wj9c-mxmx|body-parser>qs" + "GHSA-x5fp-wj9c-mxmx|body-parser>qs", + + // AI slop CVEs (not applicable) - See dependabot alert dismissals for details + "GHSA-hp3w-g68c-fv3c|depcheck>js-yaml>argparse>sprintf-js", + "GHSA-vfj7-8cjw-p6xm|@ui5/cli>@ui5/builder>@ui5/fs>micromatch>braces", + "GHSA-vfj7-8cjw-p6xm|@ui5/fs>micromatch>braces>", + "GHSA-vfj7-8cjw-p6xm|@ui5/project>@ui5/builder>@ui5/fs>micromatch>braces>", + "GHSA-vfj7-8cjw-p6xm|@ui5/server>@ui5/builder>@ui5/fs>micromatch>braces>", + "GHSA-vfj7-8cjw-p6xm|depcheck>findup-sync>micromatch>braces", + "GHSA-vfj7-8cjw-p6xm|globby>fast-glob>micromatch>braces>", + "GHSA-vfj7-8cjw-p6xm|micromatch>braces>" ] }