[TECH] Prévenir les faux positifs dans les alertes de sécurité (PIX-5549). #4830
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
octo-topi
changed the title
|
I'm deploying this PR to these urls:
Please check it out! |
octo-topi
force-pushed
the
pix-5549-check-critical-vulnerability-issues
branch
from
0015af4 to
d136996
Compare
octo-topi
force-pushed
the
pix-5549-check-critical-vulnerability-issues
branch
from
d136996 to
000eb0f
Compare
laura-bergoens
approved these changes
Sep 21, 2022
There was a problem hiding this comment.
ca a l'air cool je suis pour essayer ! @octo-topi Don't ask for permission, ask for forgiveness 😆 go merge
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
🦄 Problème
L'installation de packages en local affiche un résumé des alertes de sécurité.
Certaines ne sont pas toujours pertinentes dans le contexte d'utilisation, par exemple sur
mon-pixl'alerte surgrowlember-cli/ember-cli-mocha#258 (comment)
Cela entraîne une baisse de vigilance sur les alertes réellement importantes.
🤖 Solution
Ajouter une librairie qui filtre les faux positifs déclarés explicitement.
Inclure la dépendance transitive concernée pour ne pas causer de faux négatifs.
🌈 Remarques
Serait-ce une bonne idée de l'inclure à la CI ?
💯 Pour tester
Commenter/modifier une ligne du fichier whitelist
audit-ci.jsonc.Exécuter
npm run audit-dependencies.Vérifier que le code retour est différent de 0.