Merge pull request #282 from staticdev/safety-ignore-tornado-vulnerab…

…ility Ignore CVE-2020-28476 affecting tornado
staticdev · Feb 3, 2021 · 59ff202 · 59ff202
2 parents 04d18fe + e924811
commit 59ff202
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/noxfile.py b/noxfile.py
@@ -99,7 +99,9 @@ def safety(session: Session) -> None:
     """Scan dependencies for insecure packages."""
     session.install("safety")
     requirements = nox_poetry.export_requirements(session)
-    session.run("safety", "check", f"--file={requirements}", "--bare")
+    # Ignore CVE-2020-28476 affecting all versions of tornado
+    # https://github.com/tornadoweb/tornado/issues/2981
+    session.run("safety", "check", f"--file={requirements}", "--bare", "--ignore=39462")
 
 
 @nox.session(python=python_versions)