mirrors/pinniped
1
0
Fork 0
mirror of https://github.com/vmware-tanzu/pinniped.git synced 2026-07-27 18:42:49 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

remove CVE-2026-24051 from trivy ignores because we upgraded that dep

Browse Source
This commit is contained in:
Ryan Richard
2026-03-27 10:32:07 -07:00
parent 532c337938
commit 782a58d002
1 changed files with 0 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pipelines/pull-requests/pipeline.yml
-8
View File
@@ -15,14 +15,6 @@ meta:
# See https://github.com/kubernetes/kubernetes/issues/128039. So we will ignore this for now.
CVE-2024-28180
# CVE-2026-24051 is in go.opentelemetry.io/otel/sdk before v1.40.0. This is an indirect dep that we
# get through various k8s modules and through fosite. The CVE description says that it only applies
# to MacOS. We do not use opentelemetry in the Pinniped CLI, and our other code never runs on MacOS,
# so we should have no exposure to this issue. We can wait for the next version of k8s packages to
# update this dependency, if they choose to do so.
# See https://ossindex.sonatype.org/vulnerability/CVE-2026-24051?component-type=golang&component-name=go.opentelemetry.io%2Fotel%2Fsdk&utm_source=nancy-client&utm_medium=integration&utm_content=1.2.0
CVE-2026-24051 exp:2026-06-04
# Save some work by skipping the full download in the implicit "get" after each of these "put" operations,
# as mentioned in the docs here: https://github.com/telia-oss/github-pr-resource#get
pr-status-handlers: