Apache
/
druid
mirror of https://github.com/apache/druid.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Skip node dev dependency vulnerability scan (#9684) 

Since they are not production dependencies, security vulnerabilities in
the dev dependencies can be ignored.
This commit is contained in:
Chi Cao Minh 2020-04-11 14:24:25 -07:00 committed by GitHub
parent cbbfd63bed
commit e6dd6a4119
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
pom.xml
View File

@ -1525,12 +1525,15 @@
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<version>5.3.0</version>
<version>5.3.2</version>
<configuration>
<cveValidForHours>24</cveValidForHours>
<failBuildOnCVSS>7</failBuildOnCVSS>
<skipProvidedScope>true</skipProvidedScope>
<skipSystemScope>true</skipSystemScope> <!-- avoid error when processing jdk.tools:jdk.tools:jar:1.8:system -->
<!-- For node analysis info, see https://github.com/jeremylong/DependencyCheck/issues/2482#issuecomment-603755623 -->
<nodeAnalyzerEnabled>false</nodeAnalyzerEnabled> <!-- plugin author (jeremylong) recommends to disable, since this analyzer is retired -->
<nodeAuditSkipDevDependencies>true</nodeAuditSkipDevDependencies>
<suppressionFile>owasp-dependency-check-suppressions.xml</suppressionFile>
</configuration>
<executions>