| Package | Affected versions | Patched versions |
|---|---|---|
| @hulumi/policies | < 1.3.2 | 1.3.2 |
Impact: @hulumi/policies versions before 1.3.2 used stack-wide evidence shortcuts in several Cloudflare and deployment-governance validators. Unrelated compliant-looking evidence could suppress violations for different zones, hostnames, origins, or repositories in the same stack.
Patched in 1.3.2: validators now correlate evidence to the specific protected resource and include regression coverage for unrelated-evidence bypasses.
Remediation: upgrade @hulumi/policies to 1.3.2 or later.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free