Skip to content

build: OSS Index scan change to warn only and exclude Guava CVE-2020-8908 as it's WONT_FIX #330

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
astubbs merged 7 commits into from
Jul 11, 2022
Merged

build: OSS Index scan change to warn only and exclude Guava CVE-2020-8908 as it's WONT_FIX #330

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
72ac264
build: Exclude Guava 31.1 from OSSIndex sec scan
astubbs Jun 1, 2022
f905cdb
...
astubbs Jul 9, 2022
10ac83a
build: Only run OSS Index audit on runtime dependencies, not tests
astubbs Jul 9, 2022
70a37cd
build: Don't fail for OSSIndex scan - will set up another CI job for …
astubbs Jul 9, 2022
f2ec1dd
fix cherry-pick
astubbs Jul 9, 2022
0d2b370
build: Only enforce requireReleaseDeps when running in CI, not locally
astubbs Jul 9, 2022
fe46618
Revert "build: Only enforce requireReleaseDeps when running in CI, no…
astubbs Jul 11, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 14 additions & 0 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -491,6 +491,20 @@
<groupId>org.sonatype.ossindex.maven</groupId>
<artifactId>ossindex-maven-plugin</artifactId>
<version>3.2.0</version>
<configuration>
<scope>runtime</scope>
<fail>false</fail>
<excludeCoordinates>
<exclude>
<!-- https://github.com/google/guava/issues/4011 -->
<!-- CVE-2020-8908: Files::createTempDir local information disclosure vulnerability #4011 -->
<!-- only used transitively from tests, and is a deprecated function -->
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>31.1-jre</version>
</exclude>
</excludeCoordinates>
</configuration>
<executions>
<execution>
<id>audit-dependencies</id>
Expand Down