diff --git a/pipelines/pull-requests/pipeline.yml b/pipelines/pull-requests/pipeline.yml index 57f268cd9..9a272a4ce 100644 --- a/pipelines/pull-requests/pipeline.yml +++ b/pipelines/pull-requests/pipeline.yml @@ -15,14 +15,6 @@ meta: # See https://github.com/kubernetes/kubernetes/issues/128039. So we will ignore this for now. CVE-2024-28180 - # CVE-2026-24051 is in go.opentelemetry.io/otel/sdk before v1.40.0. This is an indirect dep that we - # get through various k8s modules and through fosite. The CVE description says that it only applies - # to MacOS. We do not use opentelemetry in the Pinniped CLI, and our other code never runs on MacOS, - # so we should have no exposure to this issue. We can wait for the next version of k8s packages to - # update this dependency, if they choose to do so. - # See https://ossindex.sonatype.org/vulnerability/CVE-2026-24051?component-type=golang&component-name=go.opentelemetry.io%2Fotel%2Fsdk&utm_source=nancy-client&utm_medium=integration&utm_content=1.2.0 - CVE-2026-24051 exp:2026-06-04 - # Save some work by skipping the full download in the implicit "get" after each of these "put" operations, # as mentioned in the docs here: https://github.com/telia-oss/github-pr-resource#get pr-status-handlers: