chatwoot/.bundler-audit.yml at develop · bfontaine/chatwoot · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
---
ignore:
  - CVE-2021-41098 # https://github.com/chatwoot/chatwoot/issues/3097 (update once azure blob storage is updated)
  - GHSA-57hq-95w6-v4fc # Devise confirmable race condition — patched locally in User model (remove once on Devise 5+)
  # Devise 5 is currently blocked by devise-secure_password/devise_token_auth/devise-two-factor.
  # Chatwoot does not enable Timeoutable, so the timeout redirect path is not reachable.
  - GHSA-jp94-3292-c3xv
  # Rails 7.1 has no patched release for the Active Storage proxy range
  # advisories. Chatwoot limits proxy range requests locally.
  - CVE-2026-33658
  # Rails 7.1 has no patched release for this Active Storage direct-upload
  # advisory. Chatwoot filters internal metadata keys locally.
  - CVE-2026-33173
  - CVE-2026-33174
  # Rails 7.1 has no patched release for these Rails advisories. These are not
  # reachable through Chatwoot's current usage patterns and should be removed
  # once we upgrade to Rails 7.2.3.1+.
  - CVE-2026-33168
  - CVE-2026-33169
  - CVE-2026-33170
  - CVE-2026-33176
  - CVE-2026-33195
  - CVE-2026-33202