From 4a976bb749d8a2ef8bdc7121afb93e6a238fd002 Mon Sep 17 00:00:00 2001 From: Your Name Date: Wed, 27 May 2026 14:47:06 +0800 Subject: [PATCH] docs: document remaining dependency audit buckets --- docs/dependency-risk-register.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/docs/dependency-risk-register.md b/docs/dependency-risk-register.md index 060501d95..1206228d3 100644 --- a/docs/dependency-risk-register.md +++ b/docs/dependency-risk-register.md @@ -30,6 +30,19 @@ GitHub Actions also runs `.github/workflows/dependency-audit.yml` on push, pull The previous local baseline was Critical: 2 / High: 31. The remediation batches upgraded direct dependencies, patched transitive packages via `pnpm.overrides`, and removed the vulnerable `xlsx` parser dependency. +## Remaining Moderate / Low Buckets + +The current non-blocking advisories are still tracked because they may matter for specific feature surfaces: + +- `dompurify`: moderate XSS / sanitization bypass advisories from transitive rich-rendering dependencies. Treat any user-authored HTML rendering path as sensitive and prefer explicit server-side sanitization plus output escaping. +- `mermaid`: moderate XSS / CSS injection / DoS advisories from diagram rendering dependencies. Avoid enabling untrusted Mermaid diagram rendering without sandboxing and version review. +- `postcss`, `esbuild`, `brace-expansion`, `yaml`: moderate parser/dev-tooling advisories. These are primarily build-time or tooling-chain risks; keep production build and dependency audit workflows active. +- `markdown-it`, `mdast-util-to-hast`, `prismjs`: moderate Markdown/syntax-rendering advisories. Treat user-provided Markdown as untrusted and keep renderer usage behind existing sanitization boundaries. +- `uuid`, `ws`: moderate runtime/transitive advisories. Prefer patched transitive versions when upstream packages allow it; do not introduce new direct dependency pins that downgrade these packages. +- `ai`: low filetype whitelist bypass advisory currently appears in audit output even though the direct dependency is on a patched line. Keep `pnpm audit:security` as the blocking high/critical gate and revisit if severity changes. + +These buckets do not currently block release because the enforced gate is high/critical zero. They should be revisited during dependency maintenance, public Markdown/diagram feature changes, or before changing the project to a fully public repository. + ## Priority Remediation Buckets - `xlsx`: remediated by replacing spreadsheet import parsing with the existing `exceljs` dependency and dropping legacy `.xls` upload support from affected import paths.