mirror of
https://github.com/GSA/notifications-admin.git
synced 2025-12-10 15:13:40 -05:00
Updated pip-audit ignore-vulns
This changeset updates the PYSEC notices to ignore to due versions that either cannot be fixed or are false positives. Specifically, this changeset removes previously ignored vulnerability reports and adds PYSEC-2023-312 to the list because it is a false positive and refers to Redis itself, not the Python Redis client (see https://github.com/pypa/advisory-database/issues/237 for details). Signed-off-by: Carlo Costino <carlo.costino@gsa.gov>
This commit is contained in:
3
.github/workflows/checks.yml
vendored
3
.github/workflows/checks.yml
vendored
@@ -144,8 +144,7 @@ jobs:
|
||||
with:
|
||||
inputs: requirements.txt
|
||||
ignore-vulns: |
|
||||
PYSEC-2024-60
|
||||
PYSEC-2022-43162
|
||||
PYSEC-2023-312
|
||||
- name: Run npm audit
|
||||
run: make npm-audit
|
||||
|
||||
|
||||
2
.github/workflows/daily_checks.yml
vendored
2
.github/workflows/daily_checks.yml
vendored
@@ -29,6 +29,8 @@ jobs:
|
||||
- uses: pypa/gh-action-pip-audit@v1.1.0
|
||||
with:
|
||||
inputs: requirements.txt
|
||||
ignore-vulns: |
|
||||
PYSEC-2023-312
|
||||
- name: Run npm audit
|
||||
run: make npm-audit
|
||||
|
||||
|
||||
Reference in New Issue
Block a user