Skip to main content

Security Dependency Exceptions

Last reviewed: 2026-04-28

This file records dependency advisories that are accepted temporarily because they are limited to local development, evaluation, or test tooling. Runtime dependency advisories are not eligible for this exception without a separate security review.

Model evaluation npm tooling​

Scope:

  • gt-model-eval/package.json
  • gt-model-eval/package-lock.json
  • promptfoo and transitive local evaluation dependencies

Status:

  • npm audit --omit=dev is clean.
  • npm audit fix removed the critical and high findings that could be fixed without changing the direct promptfoo version.
  • A full npm audit still reports moderate uuid findings through promptfoo, natural, and Azure identity packages.

Risk decision:

gt-model-eval is a private local evaluation harness. It is not packaged into the gt release archives, not published by the npm package, and not used by the runtime CLI. The remaining findings require a breaking promptfoo change or an upstream transitive fix, so they are accepted for the local eval harness only.

Required controls:

  • npm audit --omit=dev for gt-model-eval/ must remain clean.
  • Do not expose promptfoo view or other eval servers on a public interface.
  • Do not commit generated eval result artifacts containing prompts, credentials, or model responses.
  • Renovate must include gt-model-eval/package.json so promptfoo updates are proposed automatically.
  • Re-test and remove this exception when a compatible promptfoo update clears the remaining uuid advisory chain.

Testcontainer Docker client tooling​

Scope:

  • internal/testutil
  • github.com/testcontainers/testcontainers-go
  • github.com/docker/docker as pulled by testcontainers

Status:

  • govulncheck ./cmd/gt is clean.
  • A repository scan excluding gt-model-eval/node_modules reports GO-2026-4887 and GO-2026-4883 in Docker/Moby via the testcontainer graph. The advisories currently report no fixed Docker/Moby module version.

Risk decision:

The vulnerable Docker client dependency is in the testcontainer path used by test helpers. It is not in the production cmd/gt dependency graph. The affected Moby advisories concern Docker plugin behavior and are accepted for local testcontainer usage while no fixed module version is available.

Required controls:

  • govulncheck ./cmd/gt must remain clean for release builds.
  • Do not import internal/testutil or testcontainer packages from production code.
  • Run testcontainer tests only against trusted local Docker daemons.
  • Re-check the exception when github.com/docker/docker or testcontainers ships a fixed version for these advisories.