sonatype-nexus-community / nancy

A tool to check for vulnerabilities in your Golang dependencies, powered by Sonatype OSS Index
Apache License 2.0
549 stars 76 forks source link

Disable nancy updates check #217

Closed adamdecaf closed 3 years ago

adamdecaf commented 3 years ago

nancy version 1.0.10 Checking for updates... Error: Failed to query the GitHub API for updates.

This is most likely due to GitHub rate-limiting on unauthenticated requests.

To make authenticated requests please:

  1. Generate a token at https://github.com/settings/tokens
  2. Set the token by either adding it to your ~/.gitconfig or setting the GITHUB_TOKEN environment variable.

Instructions for generating a token can be found at: https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line/

We call the GitHub releases API to look for new releases. More information about that API can be found here: https://developer.github.com/v3/repos/releases/

: GET https://api.github.com/repos/sonatype-nexus-community/nancy/releases: 403 API rate limit exceeded for 199.19.85.33. (But here's the good news: Authenticated requests get a higher rate limit. Check out the documentation for more details.) [rate reset in 33m03s]

cc @bhamail / @DarthHater

adamdecaf commented 3 years ago

FWIW I've tried to disable this check by writing the config file, but that seems to not work. (Invalid timestamp format)

See: https://github.com/moov-io/infra/pull/159

DarthHater commented 3 years ago

Thanks for filing the issue @adamdecaf ! @bhamail wrote this feature, I imagine he's going to be really interested in this!

bhamail commented 3 years ago

@adamdecaf Thanks for reporting this. I just released a new version that should solve the problem (so hopefully you can remove your workaround on the update_check.yml file) (neat idea BTW!). Please let us know how the new version works for you.

adamdecaf commented 3 years ago

Awesome, many thanks!