From e9ace75f5f792cb7e9ddf8643fa8908b6766ea36 Mon Sep 17 00:00:00 2001
From: lekhrocks <lekh.nith@gmail.com>
Date: Thu, 8 Oct 2026 18:40:39 +0530
Subject: [PATCH] =?UTF-8?q?security:=20triage=203=20critical=20CVEs=20?=
 =?UTF-8?q?=E2=80=94=20bump=20proxy-addr,=20suppress=202=20unexploitable?=
 =?UTF-8?q?=20findings?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- CVE-2026-90711 (proxy-addr IP spoofing): bump 2.0.7 -> 2.0.8 in website
  lockfile; within express's ~2.0.7 range, clean lockfile-only update.
- CVE-2026-47884 (Spring XsltView RCE): suppress with justification — app is
  REST-only, no XsltView/ViewResolver usage; no 6.2.x fix exists (7.0.9 only).
- CVE-2026-104849 (tinypool prototype pollution): suppress with justification —
  build-time Docusaurus SSG only, single-arg pool.run() unaffected per advisory.
---
 gradle/dependency-check-suppressions.xml | 14 ++++++++++++++
 website/package-lock.json                | 10 +++++++---
 2 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/gradle/dependency-check-suppressions.xml b/gradle/dependency-check-suppressions.xml
index 5069734..b5d9e53 100644
--- a/gradle/dependency-check-suppressions.xml
+++ b/gradle/dependency-check-suppressions.xml
@@ -8,4 +8,18 @@
             <cve>CVE-XXXX-YYYY</cve>
         </suppress>
     -->
+    <suppress>
+        <notes>CVE-2026-47884 (XsltView RCE): not exploitable. Requires XsltView with a /** view mapping;
+            this app is REST-only (no ViewResolver, ModelAndView, or XsltView usage). No 6.2.x fix exists;
+            patched only in Spring Framework 7.0.9 / Spring Boot 4. Remove on Boot 4 migration.</notes>
+        <cve>CVE-2026-47884</cve>
+    </suppress>
+    <suppress>
+        <notes>CVE-2026-104849 (tinypool prototype pollution): build-time only (Docusaurus SSG in website/),
+            not shipped code. Exploit requires pool.run(task, options) without an own filename property;
+            @docusaurus/core calls pool.run(task) single-arg, which the advisory states is unaffected.
+            No 1.x fix; 2.1.2 is a major bump outside docusaurus's ^1.0.2 range. Remove when docusaurus
+            migrates to tinypool 2.x.</notes>
+        <cve>CVE-2026-104849</cve>
+    </suppress>
 </suppressions>
diff --git a/website/package-lock.json b/website/package-lock.json
index afe9792..a53184c 100644
--- a/website/package-lock.json
+++ b/website/package-lock.json
@@ -16864,9 +16864,9 @@
       "license": "ISC"
     },
     "node_modules/proxy-addr": {
-      "version": "2.0.7",
-      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.7.tgz",
-      "integrity": "sha512-llQsMLSUDUPT44jdrU/O37qlnifitDP+ZwrmmZcoSKyLKvtZxpyV0n2/bD/N4tBAAZ/gJEdZU7KMraoK1+XYAg==",
+      "version": "2.0.8",
+      "resolved": "https://registry.npmjs.org/proxy-addr/-/proxy-addr-2.0.8.tgz",
+      "integrity": "sha512-5nnx0yGyVUcY6t9RnWcARWtwT9F1D8O9rt08htPvnd49W1IgZtmLkhu9WfMzQj1cFxjHIO6connUNVW5k7AVyQ==",
       "license": "MIT",
       "dependencies": {
         "forwarded": "0.2.0",
@@ -16874,6 +16874,10 @@
       },
       "engines": {
         "node": ">= 0.10"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/express"
       }
     },
     "node_modules/proxy-addr/node_modules/ipaddr.js": {