fix: ignoring `jinja2` vulnerability ID

ansys / actions

A collection of reusable workflows

https://actions.docs.ansys.com/

MIT License

10 stars 5 forks source link

fix: ignoring `jinja2` vulnerability ID #505

Closed clatapie closed 3 months ago

clatapie commented 3 months ago

jinja2 is a required dependency for the check-vulnerability.py scripts. Due to jinja2 safety result, the check-vulnerabilities action is failing.

ansys-reviewer-bot[bot] commented 3 months ago

Thanks for opening a Pull Request. If you want to perform a review write a comment saying:

@ansys-reviewer-bot review

SMoraisAnsys commented 3 months ago

@jorgepiloto Yeah, I do agree (that would also help to know when new releases patch the issues) For the one added : https://data.safetycli.com/v/70612/97c/ and it affects versions >= 0

clatapie commented 3 months ago

@jorgepiloto, as it's a .txt file, it should not be a problem indeed

RobPasMue commented 3 months ago

Links are available in the rendered docs: https://actions.docs.ansys.com/version/dev/vulnerability-actions/index.html Search for "Accepted safety vulnerabilities"

Comments would be fine too for explaining why we are ignoring it

clatapie commented 3 months ago

Comments have been added in https://github.com/ansys/actions/pull/506.