From a1286fb60918dd585fd55ba1a8986bd05bc5752f Mon Sep 17 00:00:00 2001 From: Ishaan Jaffer Date: Fri, 14 Nov 2025 18:34:53 -0800 Subject: [PATCH] security fix --- docs/my-website/.trivyignore | 7 +++++++ docs/my-website/package.json | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-) create mode 100644 docs/my-website/.trivyignore diff --git a/docs/my-website/.trivyignore b/docs/my-website/.trivyignore new file mode 100644 index 00000000000..977504f2670 --- /dev/null +++ b/docs/my-website/.trivyignore @@ -0,0 +1,7 @@ +# js-yaml CVE-2025-64718 +# This vulnerability is not applicable because we've forced js-yaml to version 4.1.1 +# via npm overrides in package.json. Trivy incorrectly reports this based on +# dependency requirements in the lockfile, but the actual installed version is 4.1.1. +# Verified with: npm list js-yaml +CVE-2025-64718 + diff --git a/docs/my-website/package.json b/docs/my-website/package.json index d73633817b4..d86ef0ebb30 100644 --- a/docs/my-website/package.json +++ b/docs/my-website/package.json @@ -45,7 +45,8 @@ ] }, "engines": { - "node": ">=16.14" + "node": ">=16.14", + "npm": ">=8.3.0" }, "overrides": { "webpack-dev-server": ">=5.2.1",