Ability to suppress vulnerability warnings
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 16
- Forks
- 7
- PR merge metrics
- No merged PRs in 30d
Description
A concrete case. One of our top level modules referenced in the ref arch depends on a module which then depends on a module.. which in terms depends on https://www.npmjs.com/package/opencollective. That module uses and old version of node-fetch that is reported as having a high vulnerability.
Looking at the module and what it does it's clearly not an issue.
@richardlau did you have any thoughts about how we might have an exclude list when you did the original work on the vulnerability checks?
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests. Begin by locating the vulnerability-checking code and tracing the transitive dependency path through opencollective; done means an explicit exclusion can suppress this warning while unrelated vulnerability checks still report normally.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- security, tooling
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100