13 lines
765 B
TOML
13 lines
765 B
TOML
|
# OSV-Scanner suppression for this Maven manifest. OSV-Scanner looks for an
|
||
|
|
# osv-scanner.toml next to each manifest it scans, and the repo-root config does
|
||
|
|
# not cover Maven sub-directory scans — so the jackson finding is suppressed
|
||
|
|
# here as well. See the root osv-scanner.toml and the SECURITY.md VEX section.
|
||
|
|
#
|
||
|
|
# tools.jackson.core:jackson-core 3.x is NOT a dependency of this project. Full
|
||
|
|
# Maven resolution (the publishing plugin tree and the project dependency tree)
|
||
|
|
# resolves only jackson 2.16.1 / 2.17.1; tools.jackson 3.x appears nowhere.
|
||
|
|
# OSV-Scanner's own resolver flags it as a false positive.
|
||
|
|
[[IgnoredVulns]]
|
||
|
|
id = "GHSA-72hv-8253-57qq"
|
||
|
|
reason = "tools.jackson.core:jackson-core 3.x is not a dependency; only jackson 2.x resolves. Not affected."
|