ci: fix semgrep crash and accept 3 unfixable OSV advisories

.github/workflows/quality-gates.yml

@@ -13,7 +13,8 @@ name: quality-gates
 # job runs the canonical `claude plugin validate`.
 #
 # The five plugin-gate reusables are merged into modeled-information-format/.github
-# (#12, cosign-signer fix #13) and pinned to that merged main SHA.
+# (#12, cosign-signer fix #13) and pinned by full main SHA per gate — not one
+# shared SHA: semgrep is on a later main SHA carrying Semgrep 1.180.0 (#90).
 
 "on":
   push:
@@ -96,7 +97,7 @@ jobs:
       security-events: write
       actions: read
     uses: >-
-      modeled-information-format/.github/.github/workflows/reusable-semgrep.yml@5c856f8118976bfd3bb64a8911f69dc9b00b4cad
+      modeled-information-format/.github/.github/workflows/reusable-semgrep.yml@63155e10b6f837069f71442f2e49186dd91d6509
     with:
       directory: .
 

.github/workflows/release.yml

@@ -160,7 +160,7 @@ jobs:
     needs: [meta]
     permissions: { contents: read, security-events: write, actions: read }
     uses: >-
-      modeled-information-format/.github/.github/workflows/reusable-semgrep.yml@5c856f8118976bfd3bb64a8911f69dc9b00b4cad
+      modeled-information-format/.github/.github/workflows/reusable-semgrep.yml@63155e10b6f837069f71442f2e49186dd91d6509
   gate-secrets:
     needs: [meta]
     permissions: { contents: read, security-events: write, actions: read }

osv-scanner.toml

@@ -0,0 +1,39 @@
+# OSV-Scanner configuration.
+#
+# Accepted, justified vulnerability exceptions for the Astro/Starlight catalog
+# site's package-lock.json (the only lockfile in this repo). Each entry is a
+# deliberate risk decision, not a silent suppression: no fix reachable within
+# the upstream dependency ranges, and no untrusted input reaching the affected
+# code. Revisit on each release and on every dependency bump; remove an entry
+# as soon as the fix becomes resolvable.
+
+[[IgnoredVulns]]
+id = "GHSA-vfj7-8cjw-p6xm"
+# braces 3.0.3: stack-exhaustion DoS on deeply nested brace patterns. No fixed
+# release exists (3.0.3 is the last affected and latest version). Build-time
+# only, via starlight-llms-txt -> micromatch (^3.0.3), where the patterns come
+# from this repo's own build config, never from user input; not part of the
+# deployed static site. Remove this entry once a fixed braces release ships.
+reason = "No fixed braces release exists; build-time-only transitive (starlight-llms-txt -> micromatch) matching repo-authored patterns, never untrusted input; no production exposure. Revisit when braces ships a fix."
+
+[[IgnoredVulns]]
+id = "GHSA-238p-pmpm-9mq7"
+# katex 0.16.47, CVSS 2.1 (low). Pulled in only by mermaid 11 (via
+# astro-mermaid), which pins katex ^0.16; the fix is 0.18.2, outside that
+# range. KaTeX is only a read-side gadget: exploiting it requires prototype
+# pollution that already exists in the page. Mermaid only invokes KaTeX for
+# math in diagram labels; this site's diagrams are repo-authored (one diagram,
+# in docs/index.md) and contain no math, and no untrusted input reaches them.
+# Remove this entry once mermaid accepts katex >= 0.18.2.
+reason = "Low-severity katex advisory requiring pre-existing prototype pollution; only reachable through mermaid, which pins katex ^0.16 (fix is 0.18.2). Diagrams are repo-authored with no math; no untrusted input reaches KaTeX. Revisit when mermaid bumps katex."
+
+[[IgnoredVulns]]
+id = "GHSA-rj75-hqrm-r3gf"
+# postcss-selector-parser 6.1.4: quadratic-time parsing of very long flat
+# selectors (CPU exhaustion). Fixed only in 7.1.6, but the sole consumer is
+# postcss-nested 6.2.0 (requires ^6.1.1), pinned via @astrojs/starlight ->
+# expressive-code -> @expressive-code/core (postcss-nested ^6.0.1). Build-time
+# only: it parses the repo's own code-block theme CSS while `astro build`
+# runs, never untrusted input, and is not shipped in the deployed static site.
+# Remove this entry once expressive-code moves to postcss-nested >= 7.
+reason = "Fix (7.1.6) is outside postcss-nested 6.x's ^6.1.1 range, pinned by Starlight's expressive-code; build-time-only parsing of repo-authored CSS, never untrusted input; no production exposure. Revisit when expressive-code bumps postcss-nested."

package.json

@@ -17,8 +17,7 @@
     "esbuild": "0.28.1"
   },
   "allowScripts": {
-    "esbuild@0.28.1": true,
-    "sharp@0.35.3": true
+    "esbuild@0.28.1": true
   },
   "devDependencies": {
     "starlight-llms-txt": "0.12.0"