From b1c7610b642e32195d0f6323bd7bdd70a32d889e Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Mon, 17 Aug 2026 10:58:19 -0700 Subject: [PATCH] ignore an unrelated CVE that nancy complains about Signed-off-by: Ryan Richard --- pipelines/pull-requests/pipeline.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/pipelines/pull-requests/pipeline.yml b/pipelines/pull-requests/pipeline.yml index 1da1b1c70..ba1788430 100644 --- a/pipelines/pull-requests/pipeline.yml +++ b/pipelines/pull-requests/pipeline.yml @@ -660,6 +660,12 @@ jobs: # See https://ossindex.sonatype.org/vulnerability/CVE-2026-24051?component-type=golang&component-name=go.opentelemetry.io%2Fotel%2Fsdk&utm_source=nancy-client&utm_medium=integration&utm_content=1.2.0 CVE-2026-24051 until=2026-06-04 + # CVE-2026-56860 is "net/url: avoid quadratic complexity in resolvePath" which is in the Go std lib, + # but nancy also detects it in golang.org/x/net@v0.57.0. If it is in there, we are not using it + # for url paths. We only use golang.org/x/net for some tests. Also, there is currently no newer version + # available, so we can't upgrade it at the moment. + CVE-2026-56860 until=2026-10-17 + EOF cat pinniped-modules/modules.json | nancy sleuth \