diff options
| -rw-r--r-- | deny.toml | 2 | ||||
| -rw-r--r-- | osv-scanner.toml | 2 | ||||
| -rw-r--r-- | test/deny.toml | 2 | ||||
| -rw-r--r-- | test/osv-scanner.toml | 2 |
4 files changed, 8 insertions, 0 deletions
@@ -1,3 +1,5 @@ +# Keep this file in sync with osv-scanner.toml + [graph] # cargo deny will only evaluate dependencies pulled in by these # targets (the ones we ship Rust code to) diff --git a/osv-scanner.toml b/osv-scanner.toml index b87ae7ea2f..7df9f816d2 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -1,5 +1,7 @@ # List of ignored known vulnerabilities # +# Keep this file in sync with deny.toml +# # When osv-scanner reports a vulnerability, evaluate if the vulnerability affects the security # of our app. If it does, escalate the issue and discuss in the team and with tech leadership. # If the vulnerability does *not* affect the security of the app, there are three ways to fix it. diff --git a/test/deny.toml b/test/deny.toml index 3725418cfc..4bb1b7bc73 100644 --- a/test/deny.toml +++ b/test/deny.toml @@ -1,3 +1,5 @@ +# Keep this file in sync with test/osv-scanner.toml + [graph] # cargo deny will only evaluate dependencies pulled in by these # targets (the ones we run the test runner on) diff --git a/test/osv-scanner.toml b/test/osv-scanner.toml index 12125290e2..7c5a285d80 100644 --- a/test/osv-scanner.toml +++ b/test/osv-scanner.toml @@ -1,4 +1,6 @@ # See repository root `osv-scanner.toml` for instructions and rules for this file. +# +# Keep this file in sync with test/deny.toml # `instant` is unmaintained. [[IgnoredVulns]] |