Open anastasialanz opened 7 months ago
Hi @anastasialanz , as a paying customer of Prisma Cloud, you may reach out to your Customer Success representative so they can assist you 🙂
@anastasialanz thanks for reaching out! The flag you're using is for "package" level skipping, e.g., skip_cve_package: next
. To skip the CVE, you need to use: skip_check: CKV_CVE_2023_46298
as documented here: https://www.checkov.io/2.Basics/Suppressing%20and%20Skipping%20Policies.html
I hope that helps!
When testing out the functionality of the
skip_cve_package
parameter, I set it toCVE-2023-46298
to ignore this issue in the next.js package. After running the Checkov GitHub action, the PR still fails. Is there something else I would need to do to not have it fail if this package can't be updated immediately?Example
checkov.yml
GitHub ActionCLI output: