Skip to content

Commit

Permalink
chore(deps): remove CVE-2023-41040 from audit's ignore list
Browse files Browse the repository at this point in the history
Signed-off-by: behnazh-w <[email protected]>
  • Loading branch information
behnazh-w committed Sep 13, 2023
1 parent dd1aa30 commit 11a1b64
Showing 1 changed file with 1 addition and 5 deletions.
6 changes: 1 addition & 5 deletions Makefile
Original file line number Diff line number Diff line change
Expand Up @@ -225,16 +225,12 @@ requirements.txt: pyproject.toml
# editable mode (like the one in development here) because they may not have
# a PyPI entry; also print out CVE description and potential fixes if audit
# found an issue.
# TODO: do not ignore CVE-2023-41040 once the patch is out.
# Macaron is not affected by this CVE because it does not call the problematic functions like `commit`
# and sanitizes arguments before calling GitPython APIs.
# See: https://osv.dev/vulnerability/GHSA-cwvm-v4w8-q58c
.PHONY: audit
audit:
if ! $$(python -c "import pip_audit" &> /dev/null); then \
echo "No package pip_audit installed, upgrade your environment!" && exit 1; \
fi;
python -m pip_audit --skip-editable --desc on --fix --dry-run --ignore-vuln CVE-2023-41040
python -m pip_audit --skip-editable --desc on --fix --dry-run

# Run some or all checks over the package code base.
.PHONY: check check-code check-bandit check-flake8 check-lint check-mypy check-go check-actionlint
Expand Down

0 comments on commit 11a1b64

Please sign in to comment.