From 5919df85d15832fbba75122f5fa624a13399c9ec Mon Sep 17 00:00:00 2001 From: Colton Padden Date: Sun, 21 Nov 2021 09:39:02 -0500 Subject: [PATCH] Add .snyk ignore file for @techdocs/cli Ignores with 6-month duration for vulnerabilities that have also been ignored for @backstage/cli: - SNYK-JS-BROWSERSLIST-1090194 - SNYK-JS-IMMER-1540542 Signed-off-by: Colton Padden --- packages/techdocs-cli/.snyk | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) create mode 100644 packages/techdocs-cli/.snyk diff --git a/packages/techdocs-cli/.snyk b/packages/techdocs-cli/.snyk new file mode 100644 index 0000000000..cfb30e5aa7 --- /dev/null +++ b/packages/techdocs-cli/.snyk @@ -0,0 +1,17 @@ +# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities. +version: v1.22.1 +# ignores vulnerabilities until expiry date; change duration by modifying expiry date +ignore: + SNYK-JS-BROWSERSLIST-1090194: + - '*': + reason: Developer tools are not a valid target for ReDoS attacks + expires: 2022-05-20T00:00:00.000Z + created: 2021-11-20T00:00:00.000Z + + SNYK-JS-IMMER-1540542: + - '*': + reason: Prototype pollution is not an effective attack against a CLI as it already executes arbitrary code + expires: 2022-05-20T00:00:00.000Z + created: 2021-11-20T00:00:00.000Z + +patch: {}