From 782a58d00288ed6220ff50b26df1d3697bac1f4b Mon Sep 17 00:00:00 2001 From: Ryan Richard Date: Fri, 27 Mar 2026 10:32:07 -0700 Subject: [PATCH] remove CVE-2026-24051 from trivy ignores because we upgraded that dep --- pipelines/pull-requests/pipeline.yml | 8 -------- 1 file changed, 8 deletions(-) diff --git a/pipelines/pull-requests/pipeline.yml b/pipelines/pull-requests/pipeline.yml index 57f268cd9..9a272a4ce 100644 --- a/pipelines/pull-requests/pipeline.yml +++ b/pipelines/pull-requests/pipeline.yml @@ -15,14 +15,6 @@ meta: # See https://github.com/kubernetes/kubernetes/issues/128039. So we will ignore this for now. CVE-2024-28180 - # CVE-2026-24051 is in go.opentelemetry.io/otel/sdk before v1.40.0. This is an indirect dep that we - # get through various k8s modules and through fosite. The CVE description says that it only applies - # to MacOS. We do not use opentelemetry in the Pinniped CLI, and our other code never runs on MacOS, - # so we should have no exposure to this issue. We can wait for the next version of k8s packages to - # update this dependency, if they choose to do so. - # See https://ossindex.sonatype.org/vulnerability/CVE-2026-24051?component-type=golang&component-name=go.opentelemetry.io%2Fotel%2Fsdk&utm_source=nancy-client&utm_medium=integration&utm_content=1.2.0 - CVE-2026-24051 exp:2026-06-04 - # Save some work by skipping the full download in the implicit "get" after each of these "put" operations, # as mentioned in the docs here: https://github.com/telia-oss/github-pr-resource#get pr-status-handlers: