From 4f133d802fc75704828f33a0e3ebcc67b0f1df32 Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Tue, 3 Nov 2026 11:16:49 -0800 Subject: [PATCH] update scan-dependencies allow list in pr pipeline Signed-off-by: Ryan Richard --- pipelines/pull-requests/pipeline.yml | 30 ++++++---------------------- 1 file changed, 6 insertions(+), 24 deletions(-) diff --git a/pipelines/pull-requests/pipeline.yml b/pipelines/pull-requests/pipeline.yml index f14470111..07cbf4a87 100644 --- a/pipelines/pull-requests/pipeline.yml +++ b/pipelines/pull-requests/pipeline.yml @@ -640,31 +640,13 @@ jobs: # and clean this file later. # CVE-0000-00000 until=2022-01-01 - # CVE-2020-8561 is in k8s.io/apiserver. - # From the comments on this issue https://github.com/kubernetes/kubernetes/issues/104720 - # it seems like the Kubernetes maintainers are never going to fix it. - # Removing the "until" date on the next line to ignore this CVE forever. - CVE-2020-8561 + # CVE-2026-116586 CWE-674: Uncontrolled Recursion in go-jose v3. + # Temporarily ignoring this to allow other PRs to continue to merge while we decide how to handle this. + CVE-2026-116586 until=2026-11-25 - # CVE-2025-27144 is in github.com/go-jose/go-jose. We are already using the versions which contain - # the fix v3.0.4 and v4.0.5, but for some reason nancy is complaining about it, so ignore it. - # See https://github.com/go-jose/go-jose/security/advisories/GHSA-c6gw-w398-hv78 which says that - # 3.0.4 and 4.0.5 contain the fix. - CVE-2025-27144 - - # CVE-2026-24051 is in go.opentelemetry.io/otel/sdk before v1.40.0. This is an indirect dep that we - # get through various k8s modules and through fosite. The CVE description says that it only applies - # to MacOS. We do not use opentelemetry in the Pinniped CLI, and our other code never runs on MacOS, - # so we should have no exposure to this issue. We can wait for the next version of k8s packages to - # update this dependency, if they choose to do so. - # See https://ossindex.sonatype.org/vulnerability/CVE-2026-24051?component-type=golang&component-name=go.opentelemetry.io%2Fotel%2Fsdk&utm_source=nancy-client&utm_medium=integration&utm_content=1.2.0 - CVE-2026-24051 until=2026-06-04 - - # CVE-2026-56860 is "net/url: avoid quadratic complexity in resolvePath" which is in the Go std lib, - # but nancy also detects it in golang.org/x/net@v0.57.0. If it is in there, we are not using it - # for url paths. We only use golang.org/x/net for some tests. Also, there is currently no newer version - # available, so we can't upgrade it at the moment. - CVE-2026-56860 until=2026-10-17 + # CVE-2026-116585 CWE-129: Improper Validation of Array Index in go-jose v3. + # Temporarily ignoring this to allow other PRs to continue to merge while we decide how to handle this. + CVE-2026-116585 until=2026-11-25 EOF