mirrors/pinniped
1
0 Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-11-08 04:19:07 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

update scan-dependencies allow list in pr pipeline

Browse Source 
Signed-off-by: Ryan Richard <richardry@vmware.com>
This commit is contained in:
Ryan Richard committed 2026-11-03 11:16:49 -08:00
1 parent 1d7544a0b7
commit 4f133d802f
1 file changed
+6 -24
Download Patch File Download Diff File Expand all files Collapse all files
pipelines/pull-requests/pipeline.yml
+6 -24
View File
@@ -640,31 +640,13 @@ jobs:
# and clean this file later.
# CVE-0000-00000 until=2022-01-01
# CVE-2020-8561 is in k8s.io/apiserver.
# From the comments on this issue https://github.com/kubernetes/kubernetes/issues/104720
# it seems like the Kubernetes maintainers are never going to fix it.
# Removing the "until" date on the next line to ignore this CVE forever.
CVE-2020-8561
# CVE-2026-116586 CWE-674: Uncontrolled Recursion in go-jose v3.
# Temporarily ignoring this to allow other PRs to continue to merge while we decide how to handle this.
CVE-2026-116586 until=2026-11-25
# CVE-2025-27144 is in github.com/go-jose/go-jose. We are already using the versions which contain
# the fix v3.0.4 and v4.0.5, but for some reason nancy is complaining about it, so ignore it.
# See https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78 which says that
# 3.0.4 and 4.0.5 contain the fix.
CVE-2025-27144
# CVE-2026-24051 is in go.opentelemetry.io/otel/sdk before v1.40.0. This is an indirect dep that we
# get through various k8s modules and through fosite. The CVE description says that it only applies
# to MacOS. We do not use opentelemetry in the Pinniped CLI, and our other code never runs on MacOS,
# so we should have no exposure to this issue. We can wait for the next version of k8s packages to
# update this dependency, if they choose to do so.
# See https://ossindex.sonatype.org/vulnerability/CVE-2026-24051?component-type=golang&component-name=go.opentelemetry.io%2Fotel%2Fsdk&utm_source=nancy-client&utm_medium=integration&utm_content=1.2.0
CVE-2026-24051 until=2026-06-04
# CVE-2026-56860 is "net/url: avoid quadratic complexity in resolvePath" which is in the Go std lib,
# but nancy also detects it in golang.org/x/net@v0.57.0. If it is in there, we are not using it
# for url paths. We only use golang.org/x/net for some tests. Also, there is currently no newer version
# available, so we can't upgrade it at the moment.
CVE-2026-56860 until=2026-10-17
# CVE-2026-116585 CWE-129: Improper Validation of Array Index in go-jose v3.
# Temporarily ignoring this to allow other PRs to continue to merge while we decide how to handle this.
CVE-2026-116585 until=2026-11-25
EOF