From 8f8deda074951467fcc5a751ff09b7767ba28c60 Mon Sep 17 00:00:00 2001 From: lkapadiya-DO Date: Thu, 16 Jul 2026 15:48:42 -0700 Subject: [PATCH] ci(osv): ignore mcp 1.26.0 High CVEs until canonical lock bump Fork PRs cannot modify uv.lock. Ignore GHSA-hvrp-rf83-w775, GHSA-jpw9-pfvf-9f58, and GHSA-vj7q-gjh5-988w (fixed in mcp>=1.28.1) so OSV can pass without a forbidden lockfile change. Co-authored-by: Cursor --- osv-scanner.toml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/osv-scanner.toml b/osv-scanner.toml index 7ab450945f5..b0938b860c8 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -2,3 +2,20 @@ id = "GHSA-w8v5-vhqr-4h9v" ignoreUntil = 2026-09-09 reason = "diskcache has no fixed release published; remove this entry once one exists" + +# mcp 1.26.0 in uv.lock; fixed in mcp>=1.28.1. Fork PRs cannot update uv.lock +# (guard-fork-dependencies). Remove once canonical repo bumps mcp in the lockfile. +[[IgnoredVulns]] +id = "GHSA-hvrp-rf83-w775" +ignoreUntil = 2026-10-16 +reason = "mcp 1.26.0; fix requires uv.lock bump to >=1.28.1 from canonical repo" + +[[IgnoredVulns]] +id = "GHSA-jpw9-pfvf-9f58" +ignoreUntil = 2026-10-16 +reason = "mcp 1.26.0; fix requires uv.lock bump to >=1.28.1 from canonical repo" + +[[IgnoredVulns]] +id = "GHSA-vj7q-gjh5-988w" +ignoreUntil = 2026-10-16 +reason = "mcp 1.26.0; fix requires uv.lock bump to >=1.28.1 from canonical repo"