github/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-08-25 23:07:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

update nancy exclusions

Browse Source 
Signed-off-by: Ryan Richard <richardry@vmware.com>
This commit is contained in:
Ryan Richard
2026-08-07 12:03:36 -07:00
parent e6fec7d183
commit 6a9f9d1b33
1 changed files with 7 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pipelines/security-scan/pipeline.yml
+7 -7
View File
@@ -189,13 +189,13 @@ jobs:
# When editing this, please add an `until=` tag on each entry so we remember to revisit
# and clean this file later.
# CVE-0000-00000 until=2022-01-01
#
# CVE-2020-8561 is in k8s.io/apiserver@v0.27.1,
# which is the latest version as of 2023-05-10.
# From the comments on this issue https://github.com/kubernetes/kubernetes/issues/104720
# it seems like the Kubernetes maintainers are never going to fix it.
# Removing the "until" date on the next line to ignore this CVE forever.
CVE-2020-8561
# CVE-2026-32283 is a bug in crypto/tls before go1.25.9 and go1.26.2. We are using a newer golang,
# so we are not impacted. Nancy thinks that it is also a CVE for golang.org/x/crypto@v0.54.0.
# We only use bcrypt from x/crypto, so we can safely ignore this CVE for x/crypto.
# We will upgrade beyond v0.54.0 once a newer version is released.
CVE-2026-32283
EOF
cat pinniped-modules/modules.json | nancy sleuth \