clj-holmes / clj-watson

clojure deps SCA

Eclipse Public License 2.0

84 stars 9 forks source link

Allow List by CVEs #26

Closed markomafs closed 2 years ago

markomafs commented 2 years ago

Description

instrument a by pass of a knowing CVE for a limited date while, for example, the team is waiting for a dependency library is fixing the issue.

Type of change

[X] New feature (non-breaking change which adds functionality)
[X] This change requires a documentation update

Limitations

hard coded config file
works for github advisory only
remove the dependency from the final report
single date format "YYYY-MM-DD"

How Has This Been Tested?

[x] Use a dependency version with an expired CVE allowlist
[x] Use a dependency version with a valid CVE allowlist