From aa35fa9ca54e3a536db20b896296270ae68c93dd Mon Sep 17 00:00:00 2001 From: Michael Zalimeni Date: Tue, 26 Mar 2024 20:58:39 +0000 Subject: [PATCH] backport of commit c8d6b2528cdf861bff796d6d8e5a93e7e4c660b7 --- .release/security-scan.hcl | 11 +++++++++++ scan.hcl | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/.release/security-scan.hcl b/.release/security-scan.hcl index 5f70ffb44331..e2d04cb7053e 100644 --- a/.release/security-scan.hcl +++ b/.release/security-scan.hcl @@ -67,4 +67,15 @@ binary { ] } } + + # Triage items that are _safe_ to ignore here. Note that this list should be + # periodically cleaned up to remove items that are no longer found by the scanner. + triage { + suppress { + # N.b. `vulnerabilites` is the correct spelling for this tool. + vulnerabilites = [ + "GO-2024-2631", # go-jose/v3@v3.0.3 (false positive) + ] + } + } } diff --git a/scan.hcl b/scan.hcl index a5f8ae15c67e..87abe7b96434 100644 --- a/scan.hcl +++ b/scan.hcl @@ -22,4 +22,15 @@ repository { secrets { all = true } + + # Triage items that are _safe_ to ignore here. Note that this list should be + # periodically cleaned up to remove items that are no longer found by the scanner. + triage { + suppress { + # N.b. `vulnerabilites` is the correct spelling for this tool. + vulnerabilites = [ + "GO-2024-2631", # go-jose/v3@v3.0.3 (false positive) + ] + } + } }