0134e7f451
`bundle-audit` in CI flags an Active Storage advisory with no patched release on the Rails 7.1 line, failing lint on every open PR. Adds it to the existing `.bundler-audit.yml` ignore list. Mitigated locally; remove once on Rails 7.2.3.1+. Related to https://linear.app/chatwoot/issue/INF-92 ## Type of change - [x] Bug fix (non-breaking change which fixes an issue)
27 lines
1.2 KiB
YAML
27 lines
1.2 KiB
YAML
---
|
|
ignore:
|
|
- CVE-2021-41098 # https://github.com/chatwoot/chatwoot/issues/3097 (update once azure blob storage is updated)
|
|
- GHSA-57hq-95w6-v4fc # Devise confirmable race condition — patched locally in User model (remove once on Devise 5+)
|
|
# Devise 5 is currently blocked by devise-secure_password/devise_token_auth/devise-two-factor.
|
|
# Chatwoot does not enable Timeoutable, so the timeout redirect path is not reachable.
|
|
- GHSA-jp94-3292-c3xv
|
|
# Rails 7.1 has no patched release for the Active Storage proxy range
|
|
# advisories. Chatwoot limits proxy range requests locally.
|
|
- CVE-2026-33658
|
|
# Rails 7.1 has no patched release for this Active Storage direct-upload
|
|
# advisory. Chatwoot filters internal metadata keys locally.
|
|
- CVE-2026-33173
|
|
- CVE-2026-33174
|
|
# Rails 7.1 has no patched release for these Rails advisories. These are not
|
|
# reachable through Chatwoot's current usage patterns and should be removed
|
|
# once we upgrade to Rails 7.2.3.1+.
|
|
- CVE-2026-33168
|
|
- CVE-2026-33169
|
|
- CVE-2026-33170
|
|
- CVE-2026-33176
|
|
- CVE-2026-33195
|
|
- CVE-2026-33202
|
|
# No Rails 7.1 patch for this Active Storage advisory; mitigated locally.
|
|
# Remove once on Rails 7.2.3.1+.
|
|
- CVE-2026-66066
|