Merge pull request #9585 from BitGo/mohammadalfaiyaz/WEB-000-osv-pacote-exclusion-rel-latest

chore(deps): exclude GHSA-w4pp-8pjf-rmxw pacote DoS advisory [cherry-pick to rel/latest]

Author: mohammadalfaiyazbitgo

osv-scanner.toml

@@ -70,6 +70,10 @@ reason = "fast-uri host confusion via literal backslash authority (CVE-2026-1622
 id = "GHSA-jmr9-qjv8-65gv"
 reason = "extract-zip unvalidated symlink path traversal on extraction (CVE-2026-56876); transitive via cypress and @puppeteer/browsers, both dev-only tooling; extracted archives are Cypress/Chromium binary release downloads from trusted sources, never untrusted user-supplied zips; no upstream fix (last_affected: 2.0.1, which is the latest release). Re-evaluate on 2026-11-13: drop this exclusion if extract-zip ships a patched release"
 
+[[IgnoredVulns]]
+id = "GHSA-w4pp-8pjf-rmxw"
+reason = "pacote DoS via addGitSha on malicious spec.rawSpec (CVE-2026-9496); transitive via lerna (pinned pacote@21.0.1), @npmcli/arborist, and yeoman-generator (dev-time only); fix only in pacote 21.5.1+/22.0.0 which lerna does not yet support; all specs processed come from our own package.json/yarn.lock, never untrusted input"
+
 [[IgnoredVulns]]
 id = "GHSA-r292-9mhp-454m"
 reason = "tar stack-overflow DoS in tar.x()/tar.t() member-selection filtering; transitive via lerna and yeoman-generator requiring tar <7.5.21; fix only in tar 7.5.21+ which breaks lerna packDirectory (same constraint as GHSA-8qq5-rm4j-mr97); our usage is archive PACKING only, not extraction of untrusted archives"