Ignore CVE-2020-28476 affecting all versions of tornado

cjolowicz · Feb 1, 2021 · 01aecda · 01aecda
1 parent 51797a1
commit 01aecda
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/noxfile.py b/noxfile.py
@@ -100,7 +100,9 @@ def safety(session: Session) -> None:
     """Scan dependencies for insecure packages."""
     requirements = nox_poetry.export_requirements(session)
     session.install("safety")
-    session.run("safety", "check", f"--file={requirements}", "--bare")
+    # Ignore CVE-2020-28476 affecting all versions of tornado
+    # https://github.com/tornadoweb/tornado/issues/2981
+    session.run("safety", "check", f"--file={requirements}", "--bare", "-ignore=39462")
 
 
 @nox.session(python=python_versions)