docs(exceptions): scope temporary frontend audit exception #27
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: KofTwentyTwo/standards#27
Reference in new issue
Block a user
Website-Frontend CI currently fails on GHSA-vfj7-8cjw-p6xm in development-only braces 3.0.3. No patched package release exists. Record EX-0008 for this advisory and its propagated findings only, expiring November 10, 2026, with a review on October 17.
The implementation retains the full audit, rejects all production high/critical findings and all critical findings, checks exact locked development paths/version, fails on audit errors or expiry, and requires reassessment for any newer braces release. Lint, tests, build, secret scanning, SAST and Trivy remain enabled. No global scanner suppression is added.
Validation: Markdown lint and offline link/fragment checks pass. The consumer guard passes against the current website lockfile and regression cases for acceptance, expiry, unrelated/mixed advisories, runtime paths, critical findings, new releases and audit errors. This register change is the approval record required by the exception policy; consumer release remains gated by its normal CI.
AI review (GPT-6): reviewed
ab61e45for scope, expiry and compensating controls. EX-0008 is limited to one development-only advisory and exact package version, excludes runtime and critical findings, expires on November 10, and requires earlier reassessment for a new release. Owner requested preparation of this temporary exception. Markdown and offline links pass; all PR security/conformance/documentation checks pass. No unresolved findings in the register change. Consumer activation must wait for the reviewed guard release and its CI.