From 4fc94919996f7b7e5d16145f8d89cc5ee644b094 Mon Sep 17 00:00:00 2001 From: hc-github-team-consul-core Date: Tue, 26 Mar 2024 17:43:41 -0400 Subject: [PATCH] Backport of security: triage false positive for go-jose/v3 into release/1.15.x (#20902) backport of commit c8d6b2528cdf861bff796d6d8e5a93e7e4c660b7 Co-authored-by: Michael Zalimeni --- .release/security-scan.hcl | 11 +++++++++++ scan.hcl | 11 +++++++++++ 2 files changed, 22 insertions(+) diff --git a/.release/security-scan.hcl b/.release/security-scan.hcl index 2eec122a4915..fde6978cf31a 100644 --- a/.release/security-scan.hcl +++ b/.release/security-scan.hcl @@ -68,4 +68,15 @@ binary { ] } } + + # Triage items that are _safe_ to ignore here. Note that this list should be + # periodically cleaned up to remove items that are no longer found by the scanner. + triage { + suppress { + # N.b. `vulnerabilites` is the correct spelling for this tool. + vulnerabilites = [ + "GO-2024-2631", # go-jose/v3@v3.0.3 (false positive) + ] + } + } } diff --git a/scan.hcl b/scan.hcl index a5f8ae15c67e..87abe7b96434 100644 --- a/scan.hcl +++ b/scan.hcl @@ -22,4 +22,15 @@ repository { secrets { all = true } + + # Triage items that are _safe_ to ignore here. Note that this list should be + # periodically cleaned up to remove items that are no longer found by the scanner. + triage { + suppress { + # N.b. `vulnerabilites` is the correct spelling for this tool. + vulnerabilites = [ + "GO-2024-2631", # go-jose/v3@v3.0.3 (false positive) + ] + } + } }