Repository navigation
Date the SQLite audit suppression - #72
Merged
Merged
Conversation
Ward's repo audit needs a dated reason directly above each NuGetAuditSuppress. The reason sat above the ItemGroup with no date, so the audit failed on it. The reason also still called the app localhost-only and single-user. Since the move to PostgreSQL only Wend.Tests references SQLite, so that is now the reason.
Same correction as Directory.Build.props: only Wend.Tests references SQLite now, so the old localhost-only reason no longer applies.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ward's repo audit failed on this repo for one reason: the NuGet audit suppression in
Directory.Build.propshad no dated reason. Ward reads the comment directly above theNuGetAuditSuppressline, and ours sat above theItemGroupwith no date.What changed
docs/backlog.md).Wend.Testsreferences SQLite (in-memory, for the repository tests), so the running app never loads it.docs/backlog.mdgets the same correction to its "Why accept it" line.No package or build change. The suppressed advisory is the same one.
Checked
findSuppressions+checkSuppressionson the new file: read as dated, zero findings.dotnet restore --forceanddotnet build: 0 warnings, 0 errors, so the suppression still applies.