vulnerability-exceptions.json

{
  "purpose": "Documented, time-limited exceptions to the dependency vulnerability gate. Consumed by scripts/audit-with-exceptions.mjs, which fails the release if a finding is not listed here, if an entry has passed its reviewBy date, or if an entry no longer matches any real finding.",
  "policy": [
    "An exception records a REVIEWED ENGINEERING DECISION. It never hides a finding: every accepted item is printed on each run and is intended to be shown to a customer security reviewer.",
    "Every exception must carry a reachability analysis explaining why the vulnerable code path cannot be executed by this product, or a remediation plan with a date.",
    "Every exception expires. Passing reviewBy fails the build so the decision has to be re-made rather than inherited.",
    "status/justification use CycloneDX VEX vocabulary so the content maps onto a customer's own vulnerability-management process.",
    "An exception is scoped to one advisory and one package. A new advisory on the same package, or an increase in severity, is not covered and will fail the gate.",
    "This file is the ONLY vulnerability allowlist in the repository. A second, hardcoded allowlist in scripts/production-audit.mjs was what CI actually ran and had no reviewBy check; it has been removed and CI now runs scripts/audit-with-exceptions.mjs (finding M-19).",
    "The optional \"scope\" field names the npm workspace an entry applies to: \"root\" (the desktop application, the default) or \"server\" (the multi-tenant server, which has its own lockfile). An entry never covers a workspace it was not written for."
  ],
  "severityThreshold": "moderate",
  "exceptions": [
    {
      "advisory": "GHSA-qwww-vcr4-c8h2",
      "package": "react-router",
      "scope": "root",
      "title": "React Router: RSC Mode CSRF Bypass Allows Action Execution Before 400 Response",
      "severity": "high",
      "vulnerableRange": "7.12.0 - 8.2.0",
      "installedVersion": "7.18.2",
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "analysis": [
        "The advisory concerns React Router's RSC (React Server Components) mode, where a server action can be executed before a request is rejected with HTTP 400. Exploitation requires an RSC request handler processing server actions.",
        "TransTrack is an offline-first Electron desktop application. Its renderer uses only the client-side primitives HashRouter, Routes, Route, Link, useLocation and useNavigate (see src/App.jsx and the 12 modules importing react-router-dom). It has no RSC handler, no server actions, no data router (createBrowserRouter/RouterProvider), and no loaders, actions or fetchers. Verified by searching src/ for createBrowserRouter, RouterProvider, useFetcher, useLoaderData, useActionData and @react-router/* — no matches.",
        "There is therefore no code path in this product that reaches the vulnerable logic, and no network-facing route handler an attacker could reach.",
        "Remediation is not currently possible without an unrelated major upgrade: react-router-dom is frozen at 7.18.2 (no patched 7.x exists), and the patched react-router 8.3.0 requires React >= 19.2.7 while this product is on React 18.3.1. Forcing a React 18 to 19 migration to resolve an unreachable advisory would introduce materially more risk to a pilot than it removes, and would invalidate existing renderer validation evidence."
      ],
      "remediationPlan": "Resolve as part of the planned React 19 upgrade, which is the prerequisite for moving to the react-router 8.x line. Re-assess at the reviewBy date, or immediately if the product ever adopts a data router, server actions, or an RSC handler — any of which would make this advisory reachable and this exception invalid.",
      "assessedBy": "TransTrack engineering",
      "assessedOn": "2026-08-01",
      "reviewBy": "2026-11-01"
    }
  ]
}