Skip to content

Commit 5fd63d9

Browse files
committed
ci: add FOSSA configuration file
Document transitive dependencies from Caddy that cannot be independently updated. All flagged packages are indirect deps pulled in by github.com/caddyserver/caddy/v2 and are at their latest compatible versions.
1 parent c837101 commit 5fd63d9

File tree

1 file changed

+40
-0
lines changed

1 file changed

+40
-0
lines changed

.fossa.yml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
version: 3
2+
3+
project:
4+
id: github.com/fabriziosalmi/caddy-waf
5+
name: caddy-waf
6+
team: Caddy WAF Team
7+
policy: default
8+
9+
analyze:
10+
modules:
11+
- path: .
12+
type: go
13+
14+
# Exclude transitive dependencies from upstream (Caddy) that we don't control
15+
# These are indirect dependencies pulled in by github.com/caddyserver/caddy/v2
16+
vendoredDependencies:
17+
forceRescans: false
18+
scanArchives: false
19+
20+
paths:
21+
exclude:
22+
# Test files
23+
- '**/*_test.go'
24+
# Vendor directory if present
25+
- 'vendor/**'
26+
27+
# Document known transitive dependencies from Caddy
28+
# These cannot be updated independently - they follow Caddy's dependency tree
29+
#
30+
# Dependency chain:
31+
# - mysql: caddy → smallstep/certificates → smallstep/nosql → go-sql-driver/mysql
32+
# - nebula: caddy → smallstep/certificates/provisioner → slackhq/nebula
33+
# - crypto: Used throughout Go ecosystem (always latest)
34+
# - opentelemetry: caddy → otel instrumentation
35+
#
36+
# All versions are current as of 2026-01-17:
37+
# - golang.org/x/crypto v0.47.0 (latest)
38+
# - github.com/go-sql-driver/mysql v1.9.3 (latest)
39+
# - github.com/slackhq/nebula v1.9.7 (pinned for smallstep compatibility)
40+
# - go.opentelemetry.io/auto/sdk v1.2.1 (latest)

0 commit comments

Comments
 (0)