fix: npm vuln resolutions + VEX exceptions

.vex/npm-dev-and-unreachable.vex.json

@@ -0,0 +1,108 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/hyperdxio/hyperdx/blob/main/.vex/npm-dev-and-unreachable.vex.json",
+  "author": "HyperDX Team",
+  "role": "Supplier",
+  "timestamp": "2026-02-26T00:00:00Z",
+  "version": 4,
+  "statements": [
+    {
+      "vulnerability": { "name": "CVE-2025-14505" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "elliptic is a transitive dependency of Storybook dev tooling only (via crypto-browserify). ECDSA signing via elliptic is not used at application runtime. No patch is available upstream. The vulnerable code path (ECDSA signature generation with truncated k-nonce values) is not reachable from any production code."
+    },
+    {
+      "vulnerability": { "name": "GHSA-34x7-hfp2-rc4v" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. Arbitrary file creation via path traversal requires tar to extract attacker-controlled archives, which never occurs in this deployment."
+    },
+    {
+      "vulnerability": { "name": "GHSA-83g3-92jg-28cx" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. Hardlink escape via symlink requires extracting attacker-controlled archives, which never occurs in this deployment."
+    },
+    {
+      "vulnerability": { "name": "GHSA-8qq5-rm4j-mr97" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. Symlink overwrite requires extracting attacker-controlled archives, which never occurs in this deployment."
+    },
+    {
+      "vulnerability": { "name": "GHSA-r6q2-hw4h-h46w" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "tar is a build-only dependency pulled in transitively by cacache and node-gyp during install. It is not present in the production Docker image. The race condition via Unicode Sharp-S (ess-zett) path collision requires extracting attacker-controlled archives, which never occurs in this deployment."
+    },
+    {
+      "vulnerability": { "name": "GHSA-f8q6-p94x-37v3" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "minimatch is used exclusively in build and test tooling (glob patterns for file matching by Jest, ESLint, and similar tools). All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled pattern input, which is not possible in this usage context."
+    },
+    {
+      "vulnerability": { "name": "GHSA-3ppc-4f35-3m26" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "minimatch (CVE-2026-26996) is used exclusively in build and test tooling. All glob patterns are developer-defined strings in configuration files, not user-supplied input. A ReDoS attack requires adversary-controlled pattern input, which is not possible in this usage context."
+    },
+    {
+      "vulnerability": { "name": "GHSA-mjf5-7g4m-gx5w" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "storybook is a dev-only dependency used for UI component development. The storybook dev server (including its WebSocket endpoint) is never deployed to production and is not accessible in the production environment. WebSocket hijacking requires network access to the storybook dev server, which is only reachable on developer machines."
+    },
+    {
+      "vulnerability": { "name": "GHSA-38r7-794h-5758" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "webpack's buildHttp HttpUriPlugin (SSRF via allowedUris redirect bypass) is not enabled in this project. webpack is present only as a storybook dev dependency. The buildHttp plugin requires explicit configuration with a URL allowlist, which is absent from this project's webpack configuration."
+    },
+    {
+      "vulnerability": { "name": "GHSA-8fgc-7cc6-rx7x" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "webpack's buildHttp allowedUris bypass via URL userinfo is not exploitable here. webpack is present only as a storybook dev dependency and the buildHttp plugin is not configured in this project."
+    },
+    {
+      "vulnerability": { "name": "GHSA-4vvj-4cpr-p986" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "webpack's AutoPublicPathRuntimeModule DOM Clobbering gadget requires the attacker to inject content that overwrites document.currentScript. The vulnerable webpack npm package is a storybook dev dependency. Next.js uses its own bundled webpack copy for production builds. The resolution forces webpack to >=5.105.0 which includes the fix for this vulnerability."
+    },
+    {
+      "vulnerability": { "name": "CVE-2026-2739" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "bn.js is used internally by crypto-browserify packages (elliptic, browserify-sign, etc.) which are Storybook dev dependencies only. The infinite loop vulnerability is triggered by maskn(0) corrupting internal BN state. These crypto-browserify packages are not executed at application runtime and no user-supplied data reaches bn.js in this deployment."
+    },
+    {
+      "vulnerability": { "name": "GHSA-9wv6-86v2-598j" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_cannot_be_controlled_by_adversary",
+      "impact_statement": "path-to-regexp has two consumers: (1) express@4.22.1 uses path-to-regexp@0.1.12 which is already patched (vulnerability fixed in >=0.1.10); (2) msw@2.3.0 was upgraded to use path-to-regexp@6.3.0 (patched) via scoped yarn resolution. No vulnerable version remains installed."
+    },
+    {
+      "vulnerability": { "name": "GHSA-5j98-mcp5-4vw2" },
+      "products": [{ "@id": "pkg:npm/%40hyperdx/api" }, { "@id": "pkg:npm/%40hyperdx/app" }],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_in_execute_path",
+      "impact_statement": "glob's CLI command injection vulnerability requires invoking glob as a CLI tool with the -c/--cmd flag. glob is used exclusively as a JavaScript module for file-pattern matching in build tools (Jest, ESLint, cacache, node-gyp). The CLI entry point is never invoked in this project. All installed versions (10.5.0 patched; 7.x/9.x not in vulnerable range >=10.2.0,<10.5.0) are safe."
+    }
+  ]
+}