From d9a68970931189873d66f06ff06602cade2d9ab0 Mon Sep 17 00:00:00 2001
From: Vlad G <81777636+vladpm@users.noreply.github.com>
Date: Tue, 25 Aug 2026 11:18:37 +0100
Subject: [PATCH] chore: allowlist GHSA-ggr8-5vv4-36mx (deepmerge-ts) in audit
 gate

A new high-severity advisory in deepmerge-ts (transitive via prisma /
@prisma/config) has no non-breaking fix (npm audit fixAvailable is a
semver-major prisma change). It is reached only when merging
developer-authored Prisma config at CLI/build time, not with untrusted
runtime input, so it is not exploitable in this app. Allowlist with
justification to keep the audit gate meaningful and unblock CI. Remove
once prisma ships a patched deepmerge-ts.
---
 scripts/audit-with-allowlist.mjs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/scripts/audit-with-allowlist.mjs b/scripts/audit-with-allowlist.mjs
index e7001c6..08c79a4 100644
--- a/scripts/audit-with-allowlist.mjs
+++ b/scripts/audit-with-allowlist.mjs
@@ -20,6 +20,15 @@ const ALLOWED_ADVISORIES = new Map([
         "postcss 8.x requires nanoid 3.x, but the advisory fix range is <3.3.18 which has not been published. postcss does not call nanoid with custom generators (size !== 0), so this app is not exploitable. Remove this allowlist entry once nanoid@3.3.18+ ships or postcss adopts nanoid@5.",
     },
   ],
+  [
+    "GHSA-ggr8-5vv4-36mx",
+    {
+      package: "deepmerge-ts",
+      severity: "high",
+      reason:
+        "Transitive via prisma / @prisma/config, used only to merge developer-authored Prisma config at CLI/build time — not reachable with untrusted runtime input, so the prototype-pollution vector is not exploitable in this app. npm audit reports no non-breaking fix (fixAvailable is a semver-major prisma change). Remove once prisma ships a patched deepmerge-ts.",
+    },
+  ],
 ]);
 
 const argv = process.argv.slice(2);