safety.yml 1.8 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172
  1. version: '3.0'
  2. scanning-settings:
  3. max-depth: 6
  4. exclude: []
  5. report:
  6. dependency-vulnerabilities:
  7. enabled: true
  8. auto-ignore-in-report:
  9. python:
  10. environment-results: false
  11. unpinned-requirements: false
  12. vulnerabilities:
  13. 67136:
  14. reason: Affects documentation toolchain only
  15. expires: '2026-03-01'
  16. 67599:
  17. reason: Does not affect SieveManager as such
  18. expires: '2026-03-01'
  19. 67895:
  20. reason: Work-around in place
  21. expires: '2026-03-01'
  22. 70612:
  23. reason: Affects documentation toolchain only
  24. expires: '2026-03-01'
  25. 71064:
  26. reason: Affects documentation toolchain only
  27. expires: '2026-03-01'
  28. 71591:
  29. reason: Affects documentation toolchain only
  30. expires: '2026-03-01'
  31. 71608:
  32. reason: Affects documentation toolchain and linters only
  33. expires: '2026-03-01'
  34. 71636:
  35. reason: Affects the safety tool, not SieveManager
  36. expires: '2026-03-01'
  37. 71681:
  38. reason: Not documented upstream
  39. expires: '2026-03-01'
  40. 71684:
  41. reason: Not documented upstream
  42. expires: '2026-03-01'
  43. 72236:
  44. reason: Affects setuptools, not SieveManager
  45. expires: '2026-03-01'
  46. 72083:
  47. reason: Affects Sphinx, not SieveManager
  48. expires: '2026-03-01'
  49. fail-scan-with-exit-code:
  50. dependency-vulnerabilities:
  51. enabled: true
  52. fail-on-any-of:
  53. cvss-severity:
  54. - high
  55. - critical
  56. - medium
  57. - low
  58. exploitability:
  59. - high
  60. - critical
  61. - medium
  62. - low
  63. security-updates:
  64. dependency-vulnerabilities:
  65. auto-security-updates-limit:
  66. - patch