Kuzz007 0372515aa2 docs(ci): document the 2 known-accepted npm audit advisories ...

Neither is exploitable in this app (react-router CVE is RSC-only, we use
createBrowserRouter; jsx-a11y's brace-expansion chain only runs against our
own lint globs), and npm's suggested fixes are both downgrades with no real
forward patch published yet -- left as-is rather than trading a working
version for one that doesn't fix anything reachable here.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-26 12:42:02 +03:00

..

ISSUE_TEMPLATE

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00

workflows

docs(ci): document the 2 known-accepted npm audit advisories

2026-07-26 12:42:02 +03:00

dependabot.yml

Security hardening: sessions, SSRF, CSP nonce, CSRF logout, trusted proxies (#4275)

2026-05-13 12:52:52 +02:00

FUNDING.yml

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00

pull_request_template.md

chore(github): overhaul issue and PR templates

2026-05-24 22:14:28 +02:00