Audit fix 18 09

audit-ci.json

@@ -28,20 +28,6 @@
         "expiry": "27 September 2026"
       }
     },
-    {
-      "GHSA-5j98-mcp5-4vw2": {
-        "active": true,
-        "notes": "requires upgrade to 'glob' v10.2.2 (the v7 dependencies seem okay), which is a transitive dependency of lerna. Might be removable after lerna upgrade.",
-        "expiry": "27 September 2026"
-      }
-    },
-    {
-      "GHSA-p5wg-g6qr-c7cg": {
-        "active": true,
-        "notes": "requires upgrade to 'eslint', which requires major version(s) upgrade. This will be partly resolved by ticket #3588",
-        "expiry": "27 September 2026"
-      }
-    },
     {
       "GHSA-3ppc-4f35-3m26": {
         "active": true,
@@ -63,55 +49,13 @@
         "expiry": "27 September 2026"
       }
     },
-    {
-      "GHSA-f886-m6hf-6m8v": {
-        "active": true,
-        "notes": "brace-expansion advisory flagged via minimatch, but all resolved versions are patched (1.1.13 / 2.0.3 / 5.0.5). False positive due to audit tooling limitations; verified via npm ls.",
-        "expiry": "27 September 2026"
-      }
-    },
-    {
-      "GHSA-3v7f-55p6-f55p": {
-        "active": true,
-        "notes": "Picomatch advisory flagged during per-package audit. Root dependency graph is patched via overrides (2.3.2 / 4.0.4). Expected to resolve once lerna upgrade and workspaces migration completes.",
-        "expiry": "27 September 2026"
-      }
-    },
-    {
-      "GHSA-c2c7-rcm5-vvqj": {
-        "active": true,
-        "notes": "Picomatch advisory flagged during per-package audit. Root dependency graph is patched via overrides (2.3.2 / 4.0.4). Expected to resolve once lerna upgrade and workspaces migration completes.",
-        "expiry": "27 September 2026"
-      }
-    },
-    {
-      "GHSA-48c2-rrv3-qjmp": {
-        "active": true,
-        "notes": "yaml advisory flagged during per-package audit. Root dependency graph is patched via override (yaml@2.8.3). Expected to resolve once lerna upgrade and workspaces migration completes.",
-        "expiry": "27 September 2026"
-      }
-    },
-    {
-      "GHSA-w5hq-g745-h8pq": {
-        "active": true,
-        "notes": "requires upgrade to 'uuid', which is a transitive dependency of lerna. Might be removable after lerna upgrade.",
-        "expiry": "27 September 2026"
-      }
-    },
     {
       "GHSA-qx2v-qp2m-jg93": {
         "active": true,
         "notes": "requires upgrade to 'postcss', which is a transitive dependency of stencil. Might be removable after stencil upgrade.",
         "expiry": "27 September 2026"
       }
     },
-    {
-      "GHSA-q8mj-m7cp-5q26": {
-        "active": true,
-        "notes": "requires upgrade to 'qs', which is a transitive dependency of cypress. Might be removable after cypress upgrade.",
-        "expiry": "27 September 2026"
-      }
-    },
     {
       "GHSA-w5hq-g745-h8pq": {
         "active": true,
@@ -126,13 +70,6 @@
         "expiry": "27 September 2026"
       }
     },
-    {
-      "GHSA-mh99-v99m-4gvg": {
-        "active": true,
-        "notes": "transitive dependency 'brace-expansion' which exists at root level and in some monorepo packages, no fix available yet.",
-        "expiry": "27 September 2026"
-      }
-    },
     {
       "GHSA-52cp-r559-cp3m": {
         "active": true,
@@ -176,65 +113,37 @@
       }
     },
     {
-      "GHSA-jjmj-jmhj-qwj2": {
-        "active": true,
-        "notes": "XXS vulnerability in redirects using 'React Router'.",
-        "expiry": "27 September 2026"
-      }
-    },
-    {
-      "GHSA-7p8r-x3mc-p8w7": {
-        "active": true,
-        "notes": "Transitive dependency fast-uri, which needs to be fixed in peer dependencies.",
-        "expiry": "27 September 2026"
-      }
-    },
-    {
-      "GHSA-mwp4-54f8-5fhr": {
-        "active": true,
-        "notes": "Transitive dependency ip-address, which needs to be fixed in peer dependencies.",
-        "expiry": "27 September 2026"
-      }
-    },
-    {
-      "GHSA-4xrf-jv44-h6hh": {
-        "active": true,
-        "notes": "Transitive dependency ip-address, which needs to be fixed in peer dependencies.",
-        "expiry": "27 September 2026"
-      }
-    },
-    {
-      "GHSA-22jq-vg5j-6vgg": {
+      "GHSA-fxqj-rqcc-2cmp": {
         "active": true,
-        "notes": "Transitive dependency ip-address, which needs to be fixed in peer dependencies.",
+        "notes": "sourcemap vulnerability around file reads in 'PostCSS'.",
         "expiry": "27 September 2026"
       }
     },
     {
-      "GHSA-fxqj-rqcc-2cmp": {
+      "GHSA-jmr9-qjv8-65gv": {
         "active": true,
-        "notes": "sourcemap vulnerability around file reads in 'PostCSS'.",
+        "notes": "extract-zip dependency vulnerability (path traversal) in unvalidated symlinks, no fix available.",
         "expiry": "27 September 2026"
       }
     },
     {
-      "GHSA-2v37-7h3g-55p8": {
+      "GHSA-w4pp-8pjf-rmxw": {
         "active": true,
-        "notes": "Transitive dependency nanoid, which needs to be fixed in peer dependencies, overflow on infinite loop.",
+        "notes": "requires upgrade to 'pacote', which is a transitive dependency of lerna. Might be removable after a lerna upgrade.",
         "expiry": "27 September 2026"
       }
     },
     {
-      "GHSA-jmr9-qjv8-65gv": {
+      "GHSA-2883-xcg3-v3hh": {
         "active": true,
-        "notes": "extract-zip dependency vulnerability (path traversal) in unvalidated symlinks, no fix available.",
+        "notes": "requires upgrade to 'js-yaml', which is a transitive dependency of lerna. Might be removable after a lerna and eslint upgrade.",
         "expiry": "27 September 2026"
       }
     },
     {
-      "GHSA-w4pp-8pjf-rmxw": {
+      "GHSA-7pqw-9j4j-h8q3": {
         "active": true,
-        "notes": "requires upgrade to 'pacote', which is a transitive dependency of lerna. Might be removable after a lerna upgrade.",
+        "notes": "requires upgrade to 'extract-zip', which is a transitive dependency of lerna. Might be removable after a lhci and cypress upgrade.",
         "expiry": "27 September 2026"
       }
     }