Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Added osv-scanner.toml file to ignore npm packages in vuln scans. #2593

Merged
merged 1 commit into from
Mar 11, 2025
Merged

Added osv-scanner.toml file to ignore npm packages in vuln scans. #2593

merged 1 commit into from
Mar 11, 2025

Conversation

aunovis-heidrich
Copy link
Contributor

Closes #2592.

@seanmonstar
Copy link
Owner

I've been wondering, would it be worth it to run an npm update in here to clear out some too? Or doesn't really make things any better?

@aunovis-heidrich
Copy link
Contributor Author

It doesn't really change much. If I remember correctly this removes round about 5 vulnerabilities (tried it last week). To really clear them out most dependencies would need to be bumped to a new major version, I suspect. But I'm really not the right person to do that in npm. :)

@seanmonstar seanmonstar merged commit e83e138 into seanmonstar:master Mar 11, 2025
35 of 36 checks passed
kodiakhq bot pushed a commit to pdylanross/fatigue that referenced this pull request Mar 12, 2025
@dependabot
chore: Bump reqwest from 0.12.12 to 0.12.13 (#402)
3d6123e 
Bumps reqwest from 0.12.12 to 0.12.13.

Release notes
Sourced from reqwest's releases.

v0.12.13
What's Changed

Add Form::into_reader() for blocking multipart forms.
Add Form::into_stream() for async multipart forms.
Add support for SOCKS4a proxies.
Fix decoding responses with multiple zstd frames.
Fix RequestBuilder::form() from overwriting a previously set Content-Type header, like the other builder methods.
Fix cloning of request timeout in blocking::Request.
Fix http3 synchronization of connection creation, reducing unneccesary extra connections.
Fix Windows system proxy to use ProxyOverride as a NO_PROXY value.
Fix blocking read to correctly reserve and zero read buffer.
(wasm) Add support for request timeouts.
(wasm) Fix Error::is_timeout() to return true when from a request timeout.

New Contributors

@​obi1kenobi made their first contribution in seanmonstar/reqwest#2524
@​decathorpe made their first contribution in seanmonstar/reqwest#2529
@​flisky made their first contribution in seanmonstar/reqwest#1760
@​0x676e67 made their first contribution in seanmonstar/reqwest#2527
@​maximevtush made their first contribution in seanmonstar/reqwest#2534
@​Property404 made their first contribution in seanmonstar/reqwest#2554
@​G1gg1L3s made their first contribution in seanmonstar/reqwest#2544
@​coastalwhite made their first contribution in seanmonstar/reqwest#2562
@​Fizcko made their first contribution in seanmonstar/reqwest#2559
@​markussilvan made their first contribution in seanmonstar/reqwest#2573
@​aunovis-heidrich made their first contribution in seanmonstar/reqwest#2593

Thanks!

@​seanmonstar
@​paolobarbolini
@​Nuhvi
@​Andrey36652

Full Changelog: seanmonstar/reqwest@v0.12.12...v0.12.13



Changelog
Sourced from reqwest's changelog.

v0.12.13

Add Form::into_reader() for blocking multipart forms.
Add Form::into_stream() for async multipart forms.
Add support for SOCKS4a proxies.
Fix decoding responses with multiple zstd frames.
Fix RequestBuilder::form() from overwriting a previously set Content-Type header, like the other builder methods.
Fix cloning of request timeout in blocking::Request.
Fix http3 synchronization of connection creation, reducing unneccesary extra connections.
Fix Windows system proxy to use ProxyOverride as a NO_PROXY value.
Fix blocking read to correctly reserve and zero read buffer.
(wasm) Add support for request timeouts.
(wasm) Fix Error::is_timeout() to return true when from a request timeout.




Commits

e44e371 v0.12.13
e83e138 Added osv-scanner.toml file to ignore npm packages in wasm examples during vu...
7e85d2f ci: pin once-cell in msrv job (#2594)
c4a9fb0 test HTTP connection reuse with new zstd fix (#2587)
6f9d0ee fix: support HTTP responses containing multiple ZSTD frames (#2583)
44ac897 perf(decoder): compile-time validation of decoder header value (#2580)
0bcba46 chore: remove empty wasm shell function (#2573)
00b15b9 fix using Windows ProxyOverride registry value as a NO_PROXY (#2559)
0cf27a9 chore: Update js-sys from 0.3.45 -> 0.3.77 (#2562)
e4ca07e ci: pin native-tls in msrv job (#2563)
Additional commits viewable in compare view




Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@seanmonstar seanmonstar seanmonstar approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

Add an osv-scanner.toml file to ignore false positive vulnerabilities
2 participants
@aunovis-heidrich @seanmonstar