Dependency review CI reports false-positive beats vulnerability
Open
automation
bug
cloudbeat
dependency
Team:Cloud Security
- Dominant language
- Go
- Stars
- 58
- Forks
- 55
- Avg merge
- 9h 9m
- Merged PRs (30d)
- 424
Description
**Motivation**
The dependency review CI always flags go.mod updates to the elastic/beats repo as it always detects [CVE-2023-49922](https://github.com/advisories/GHSA-hj4r-2c9c-29h3). This probably has to do with being forced to use a v7 tag+timestamp since the go.mod file in elastic/beats is [not updated](https://github.com/elastic/beats/issues/31202) to v8.
**Definition of done**
What needs to be completed at the end of this task
- [ ] Make CI pass
**Related tasks/epics**
- https://github.com/elastic/beats/issues/31202
- https://github.com/elastic/cloudbeat/pull/1792: Example of failing CI
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.