Compare commits
2 Commits
e66ea0dcd2
..
pr-9
| Author | SHA1 | Date | |
|---|---|---|---|
| 070f2c9ebd | |||
| 1c375c7ede |
@@ -1,15 +0,0 @@
|
|||||||
name: Renovate
|
|
||||||
on:
|
|
||||||
schedule:
|
|
||||||
- cron: '0 3 * * *'
|
|
||||||
workflow_dispatch:
|
|
||||||
jobs:
|
|
||||||
renovate:
|
|
||||||
runs-on: ubuntu-latest
|
|
||||||
steps:
|
|
||||||
- uses: actions/checkout@v4
|
|
||||||
- uses: renovatebot/github-action@v40.3.0
|
|
||||||
with:
|
|
||||||
token: ${{ secrets.GITHUB_TOKEN }}
|
|
||||||
configurationFile: renovate.json
|
|
||||||
renovate-json5: true
|
|
||||||
@@ -1,20 +0,0 @@
|
|||||||
{
|
|
||||||
// Allowlist for inherited dev-dependency CVEs from @kinvolk/headlamp-plugin
|
|
||||||
// CTO decision (PRI-854): these high-severity vulns are dev/build-time only,
|
|
||||||
// trace to @kinvolk/headlamp-plugin transitive deps (Picomatch, Vite, lodash),
|
|
||||||
// and do NOT ship in production plugin artifacts.
|
|
||||||
"allowlist": [
|
|
||||||
{
|
|
||||||
"id": "GHSA-hhpm-516h-p3p6",
|
|
||||||
"reason": "Picomatch ReDoS: devDependency only, does not ship in production plugin bundle"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "GHSA-36xf-7xpp-53w5",
|
|
||||||
"reason": "Vite arbitrary file read: devDependency only, does not ship in production plugin bundle"
|
|
||||||
},
|
|
||||||
{
|
|
||||||
"id": "GHSA-jf8v-p3pp-93qh",
|
|
||||||
"reason": "lodash code injection via _.template: devDependency only, does not ship in production plugin bundle"
|
|
||||||
}
|
|
||||||
]
|
|
||||||
}
|
|
||||||
Reference in New Issue
Block a user