Compare commits

...

2 Commits

Author SHA1 Message Date
Beverly Nguyen
f824549e18 Merge pull request #2622 from GSA/ignore-redis-false-report
Updated pip-audit ignore-vulns
2025-05-28 17:49:19 -07:00
Carlo Costino
ba0daeaf76 Updated pip-audit ignore-vulns
This changeset updates the PYSEC notices to ignore to due versions that either cannot be fixed or are false positives.  Specifically, this changeset removes previously ignored vulnerability reports and adds PYSEC-2023-312 to the list because it is a false positive and refers to Redis itself, not the Python Redis client (see https://github.com/pypa/advisory-database/issues/237 for details).

Signed-off-by: Carlo Costino <carlo.costino@gsa.gov>
2025-05-28 17:37:04 -04:00
2 changed files with 3 additions and 2 deletions

View File

@@ -144,8 +144,7 @@ jobs:
with:
inputs: requirements.txt
ignore-vulns: |
PYSEC-2024-60
PYSEC-2022-43162
PYSEC-2023-312
- name: Run npm audit
run: make npm-audit

View File

@@ -29,6 +29,8 @@ jobs:
- uses: pypa/gh-action-pip-audit@v1.1.0
with:
inputs: requirements.txt
ignore-vulns: |
PYSEC-2023-312
- name: Run npm audit
run: make npm-audit