.audit-allowlist.json

{
  "$comment": [
    "Baseline del gate de auditoría M1 (enforced vía scripts/audit-gate.mjs, alias `npm run audit:gate`).",
    "El gate corre `npm audit --omit=dev --audit-level=high` y BLOQUEA cualquier CVE high+ NUEVO en deps de",
    "PRODUCCIÓN (lo que viaja en el bundle standalone). Las advisories de acá son el backlog CONOCIDO al",
    "2026-06-22: aceptadas temporalmente para no frenar releases mientras se saldan. Cada upgrade que cierre",
    "una debe ELIMINAR su entrada (el gate avisa cuáles quedaron obsoletas). La poda del CLI npx (sacar",
    "wrangler/@opennextjs/cloudflare/@aws-sdk) eliminó las advisories transitivas de form-data, lodash, ws,",
    "flatted, minimatch y picomatch, ya quitadas de acá. Burn-down restante: subir Next a una versión sin",
    "estos CVEs (upgrade mayor, breaking) y reemplazar/quitar xlsx (sin fix)."
  ],
  "created": "2026-06-22",
  "allow": [
    { "id": "GHSA-h25m-26qc-wcjf", "pkg": "next", "severity": "high", "fix": "upgrade-mayor (breaking)", "note": "DoS deserialización RSC. Studio corre en localhost single-user: superficie de ataque remoto baja." },
    { "id": "GHSA-q4gf-8mx6-v5v3", "pkg": "next", "severity": "high", "fix": "upgrade-mayor (breaking)", "note": "DoS Server Components." },
    { "id": "GHSA-8h8q-6873-q5fj", "pkg": "next", "severity": "high", "fix": "upgrade-mayor (breaking)", "note": "DoS Server Components." },
    { "id": "GHSA-26hh-7cqf-hhc6", "pkg": "next", "severity": "high", "fix": "upgrade-mayor (breaking)", "note": "Middleware/proxy bypass (segment-prefetch)." },
    { "id": "GHSA-mg66-mrh9-m8jx", "pkg": "next", "severity": "high", "fix": "upgrade-mayor (breaking)", "note": "DoS por agotamiento de conexiones (Cache Components)." },
    { "id": "GHSA-c4j6-fc7j-m34r", "pkg": "next", "severity": "high", "fix": "upgrade-mayor (breaking)", "note": "SSRF vía WebSocket upgrades." },
    { "id": "GHSA-492v-c6pp-mqqv", "pkg": "next", "severity": "high", "fix": "upgrade-mayor (breaking)", "note": "Middleware/proxy bypass (route params)." },
    { "id": "GHSA-267c-6grr-h53f", "pkg": "next", "severity": "high", "fix": "upgrade-mayor (breaking)", "note": "Middleware/proxy bypass (segment-prefetch)." },
    { "id": "GHSA-36qx-fr4f-26g5", "pkg": "next", "severity": "high", "fix": "upgrade-mayor (breaking)", "note": "Middleware/proxy bypass (Pages Router i18n)." },
    { "id": "GHSA-4r6h-8v6p-xvw6", "pkg": "xlsx", "severity": "high", "fix": "SIN FIX", "note": "Prototype pollution SheetJS. No hay fix en npm: evaluar reemplazo o dejar de exponer import/export xlsx." },
    { "id": "GHSA-5pgg-2g8v-p4x9", "pkg": "xlsx", "severity": "high", "fix": "SIN FIX", "note": "ReDoS SheetJS. No hay fix en npm: evaluar reemplazo." }
  ]
}