mirror of
https://github.com/ossf/scorecard.git
synced 2024-09-11 08:55:27 +03:00
🐛 ignore Go stdlib vulns (#3925)
Signed-off-by: Spencer Schrock <sschrock@google.com>
This commit is contained in:
parent
e9af90c97c
commit
6e717aa261
@ -66,6 +66,11 @@ func (v osvClient) ListUnfixedVulnerabilities(
|
||||
if errors.Is(err, osvscanner.VulnerabilitiesFoundErr) {
|
||||
vulns := res.Flatten()
|
||||
for i := range vulns {
|
||||
// ignore Go stdlib vulns. The go directive from the go.mod isn't a perfect metric
|
||||
// of which version of Go will be used to build a project.
|
||||
if vulns[i].Package.Ecosystem == "Go" && vulns[i].Package.Name == "stdlib" {
|
||||
continue
|
||||
}
|
||||
response.Vulnerabilities = append(response.Vulnerabilities, Vulnerability{
|
||||
ID: vulns[i].Vulnerability.ID,
|
||||
Aliases: vulns[i].Vulnerability.Aliases,
|
||||
|
Loading…
Reference in New Issue
Block a user