kingchenc
e5e094d370
Follow-up to #272. The root `osv-scanner.toml` cleared the OpenSSF Scorecard Vulnerabilities check from score 5 to 9 (the two pyo3 advisories, which live in `Cargo.lock` at the root). One finding remained — `GHSA-72hv-8253-57qq` (jackson-core 3.x async-parser DoS) — because OSV-Scanner resolves its config relative to each manifest, and the repo-root config does not cover the Maven sub-directory scans. This adds the same not-affected suppression next to the two Maven manifests (`bindings/java`, `examples/java`). `tools.jackson.core:jackson-core` 3.x is not a dependency of this project: full Maven resolution (publishing-plugin tree + project trees) resolves only jackson `2.16.1` / `2.17.1`; tools.jackson 3.x appears nowhere. OSV-Scanner's own resolver flags it as a false positive.
13 lines
749 B
TOML
13 lines
749 B
TOML
# OSV-Scanner suppression for this Maven manifest. OSV-Scanner looks for an
|
|
# osv-scanner.toml next to each manifest it scans, and the repo-root config does
|
|
# not cover Maven sub-directory scans — so the jackson finding is suppressed
|
|
# here as well. See the root osv-scanner.toml and the SECURITY.md VEX section.
|
|
#
|
|
# tools.jackson.core:jackson-core 3.x is NOT a dependency of this project. This
|
|
# example resolves only com.fasterxml.jackson.core:jackson-databind 2.17.1 (and
|
|
# its 2.x jackson-core); tools.jackson 3.x appears nowhere. OSV-Scanner's own
|
|
# resolver flags it as a false positive.
|
|
[[IgnoredVulns]]
|
|
id = "GHSA-72hv-8253-57qq"
|
|
reason = "tools.jackson.core:jackson-core 3.x is not a dependency; only jackson 2.x resolves. Not affected."
|