# Snyk (https://snyk.io) policy file — frontend (Nuxt/yarn) project.
#
# Why this file exists next to frontend/yarn.lock (and duplicates the OSS
# `ignore:` block from the repo-root .snyk):
# Snyk resolves the open-source (SCA) policy file relative to the directory of
# the manifest being tested, NOT the repository root. A scan of
# `frontend/yarn.lock` (CLI run from the frontend project, or the Snyk platform
# importing the yarn project) therefore does not read the repo-root .snyk, so
# the accepted-risk ignores below would resurface as unresolved High findings.
# Keeping them here makes the frontend project's scan honor the same triage
# decisions. The repo-root .snyk keeps these entries too (for root-context runs)
# and additionally owns the repo-wide Snyk Code `exclude:` block. When any entry
# below is changed on expiry/re-review, update the repo-root .snyk to match.
version: v1.0.0
# Open-source vulnerability ignores (client-side policy applied by `snyk test`).
ignore:
  # Command Injection in simple-git / @simple-git/argv-parser (Critical). Pulled
  # in ONLY as a dev/build-tooling transitive:
  #   nuxt > @nuxt/devtools > simple-git > @simple-git/argv-parser
  # @nuxt/devtools is the local development UI; it uses simple-git to read repo
  # info while running `nuxt dev` on a developer's machine. It is NOT part of the
  # production runtime: `nuxt build` emits `.output/`, which the prod image runs
  # directly, and @nuxt/devtools / simple-git never ship in that artifact. The
  # injection requires attacker-controlled arguments to git commands; the only
  # inputs here are the developer's own local repo during dev, never attacker-
  # controlled production request data. No upgrade remediates it in this tree:
  # the fix lands only in simple-git 4.0.0, but every @nuxt/devtools release
  # (stable up to 3.4.2; latest tag 4.0.0-beta.2) pins simple-git ^3.x, and
  # forcing simple-git 4.x breaks the build — @nuxt/devtools does
  # `import Git from 'simple-git'` and simple-git 4 removed its default export.
  # Resolved by the Nuxt 4 / @nuxt/devtools upgrade. Time-boxed for re-review.
  SNYK-JS-SIMPLEGIT-20335524:
    - '*':
        reason: >-
          Dev/build-only transitive (nuxt dev via @nuxt/devtools); not in the
          production .output runtime. No fix installable: simple-git 4.0.0 fixes
          it but all @nuxt/devtools releases pin simple-git ^3.x and v4 breaks
          the build (default export removed). Re-review on Nuxt 4 upgrade.
        expires: 2026-12-21T00:00:00.000Z
  SNYK-JS-SIMPLEGIT-20335531:
    - '*':
        reason: >-
          Dev/build-only transitive (nuxt dev via @nuxt/devtools); not in the
          production .output runtime. No fix installable: simple-git 4.0.0 fixes
          it but all @nuxt/devtools releases pin simple-git ^3.x and v4 breaks
          the build (default export removed). Re-review on Nuxt 4 upgrade.
        expires: 2026-12-21T00:00:00.000Z
  SNYK-JS-SIMPLEGIT-20335540:
    - '*':
        reason: >-
          Dev/build-only transitive (nuxt dev via @nuxt/devtools); not in the
          production .output runtime. No fix installable: simple-git 4.0.0 fixes
          it but all @nuxt/devtools releases pin simple-git ^3.x and v4 breaks
          the build (default export removed). Re-review on Nuxt 4 upgrade.
        expires: 2026-12-21T00:00:00.000Z
  SNYK-JS-SIMPLEGITARGVPARSER-20335528:
    - '*':
        reason: >-
          Dev/build-only transitive (nuxt dev via @nuxt/devtools > simple-git);
          not in the production .output runtime. No fix installable: the fix is
          @simple-git/argv-parser 2.0.1 (simple-git 4.x), but all @nuxt/devtools
          releases pin simple-git ^3.x and v4 breaks the build (default export
          removed). Re-review on Nuxt 4 upgrade.
        expires: 2026-12-21T00:00:00.000Z
  # Improper Verification of Cryptographic Signature in node-forge (CVSS 8.7).
  # Pulled in ONLY as a build/dev-tooling transitive:
  #   nuxt > @nuxt/cli > listhen > node-forge
  # listhen uses node-forge solely to mint a self-signed cert for the local
  # `nuxt dev --https` server. node-forge is NOT part of the production runtime:
  # `nuxt build` emits `.output/`, which the prod image runs directly, and the
  # Nuxt CLI / listhen / node-forge never ship in that artifact. Every published
  # node-forge version is flagged (semver: '*') and there is no upstream fix or
  # patch available (fixedIn: []), so no upgrade can remediate it. Time-boxed so
  # it is re-evaluated once an upstream fix lands or the dep chain drops it.
  SNYK-JS-NODEFORGE-19635204:
    - '*':
        reason: >-
          Dev/build-only transitive (nuxt dev CLI self-signed cert generation via
          listhen); not present in the production .output runtime. No fixed
          node-forge version exists (all versions affected, no patch). Re-review
          on expiry.
        expires: 2026-12-07T00:00:00.000Z
  # Uncontrolled Recursion in braces (High). Reached ONLY through build-time
  # tooling, never the shipped browser bundle:
  #   @nuxt/ui > @nuxtjs/tailwindcss > tailwindcss > chokidar|fast-glob >
  #     micromatch > braces        (Tailwind CSS generation at build time)
  #   nuxt > nitropack > globby > fast-glob > micromatch > braces
  #     (Nitro build-time file globbing)
  # The recursion is driven by adversarial brace-expansion patterns; the only
  # inputs braces sees here are the project's own globs / watched paths during
  # `nuxt build`, never attacker-controlled runtime data, and braces does not
  # execute in the production .output server. Every braces version is flagged
  # (fixedIn: []), so no upgrade remediates it; the vulnerable chain is dropped
  # by the Nuxt 4 upgrade. Time-boxed for re-review.
  SNYK-JS-BRACES-19963945:
    - '*':
        reason: >-
          Build-time-only transitive (Tailwind CSS generation and Nitro file
          globbing via micromatch); not in the production .output runtime. No
          fixed braces version exists (all versions affected). Re-review on
          expiry or when the Nuxt 4 upgrade drops the chain.
        expires: 2026-12-21T00:00:00.000Z
  # Prototype Pollution in deepmerge (High). Build-time-only transitive:
  #   nuxt > nitropack > @rollup/plugin-node-resolve > deepmerge
  # deepmerge runs inside the Rollup/Nitro bundler during `nuxt build`, merging
  # bundler configuration objects only. Exploiting prototype pollution requires
  # attacker-controlled objects to be merged; the production .output server
  # never invokes this code path on request data. Every deepmerge version is
  # flagged (fixedIn: []), so no upgrade remediates it; resolved by the Nuxt 4
  # upgrade. Time-boxed for re-review.
  SNYK-JS-DEEPMERGE-19964053:
    - '*':
        reason: >-
          Build-time-only transitive (Rollup/Nitro bundler config merge); not in
          the production .output runtime request path. No fixed deepmerge version
          exists (all versions affected). Re-review on expiry or when the Nuxt 4
          upgrade drops the chain.
        expires: 2026-12-21T00:00:00.000Z
  # Uncontrolled Recursion in ioredis (High). Pulled in transitively as an
  # OPTIONAL Nitro storage driver:
  #   nuxt > nitropack > ioredis
  # ioredis is loaded only when a Redis storage mount is configured. This
  # deployment configures no Redis storage (frontend/nuxt.config.ts sets no
  # nitro.storage redis driver; default storage is memory/filesystem), so the
  # module is never instantiated at runtime. The only fix is 6.0.0-beta.1;
  # forcing a pre-release ioredis into the Nitro server is riskier than the
  # dormant finding. Re-review when a stable ioredis 6.x ships or Nuxt 4 lands.
  SNYK-JS-IOREDIS-19963957:
    - '*':
        reason: >-
          Dormant optional Nitro storage driver; no Redis storage is configured
          in this deployment, so ioredis is never loaded at runtime. Only fix is
          a pre-release (6.0.0-beta.1). Re-review on expiry.
        expires: 2026-12-21T00:00:00.000Z
  # Infinite loop in uri-js (High). Reached ONLY through dev/build-time
  # TypeScript checking tooling, never the shipped browser bundle or the
  # production server:
  #   @nuxt/typescript-build > fork-ts-checker-webpack-plugin >
  #     schema-utils > ajv > uri-js
  # ajv is pinned to 6.15.0 here (resolutions) to clear SNYK-JS-AJV-15274295,
  # but ajv 6.x still depends on uri-js ^4.2.2 and 4.4.1 is the latest 4.x —
  # every uri-js version is flagged (fixedIn: []), so no upgrade remediates it.
  # fork-ts-checker runs only during `nuxt dev`/type-check on developer and CI
  # machines; it is NOT part of the production `.output` runtime, and the only
  # inputs uri-js parses here are the project's own TS config / schema URIs,
  # never attacker-controlled request data. Dropped when @nuxt/typescript-build
  # is removed in favour of the Nuxt 4 / vue-tsc type-check path. Time-boxed.
  SNYK-JS-URIJS-19963963:
    - '*':
        reason: >-
          Dev/build-time-only transitive (TypeScript checking via
          @nuxt/typescript-build > fork-ts-checker-webpack-plugin >
          schema-utils > ajv); not in the production .output runtime. No fixed
          uri-js version exists (all versions affected; ajv 6.x requires
          uri-js 4.x). Re-review on expiry or when the typescript-build chain is
          dropped.
        expires: 2026-12-21T00:00:00.000Z
