.snyk

# Snyk (https://snyk.io) policy file, patches or ignores known vulnerabilities.
version: v1.13.5
# ignores vulnerabilities until expiry date; change duration by modifying expiry date
ignore:
  SNYK-PYTHON-BEAKER-575115:
    - '*':
        reason: >-
          No remediation available yet; Not affecting us since the storage is not accessible to any other client
        expires: 2021-02-10T06:00:00.000Z
  SNYK-PYTHON-SQLALCHEMY-173678:
    - '*':
        reason: >-
          No remediation path available for CKAN2.3 (not compatible with SQLALCHEMY > 2.7.x). Need to resolve moving to
          CKAN2.8 for catalog (https://github.com/GSA/datagov-ckan-multi/issues/298). Reviewed group_by and order_by
          usage manually, all user input sanitized.
        expires: 2021-02-23T06:00:00.000Z
  SNYK-PYTHON-SQLALCHEMY-590109:
  - '*':
      reason: >-
        No remediation path available for CKAN2.3 (not compatible with SQLALCHEMY > 2.7.x). Need to resolve moving to
        CKAN2.8 for catalog (https://github.com/GSA/datagov-ckan-multi/issues/298). Reviewed group_by and order_by
        usage manually, all user input sanitized.
      expires: 2021-02-23T06:00:00.000Z
  SNYK-PYTHON-JINJA2-455616:
    - '*':
        reason: >-
          No remediation path available for CKAN2.3 (not compatible with Jinja > 2.6.0). Need to resolve moving to
          CKAN2.8 for catalog (https://github.com/GSA/datagov-ckan-multi/issues/298). Forms for data.gov only
          accessible to government users, risk is acceptable.
        expires: 2021-02-23T06:00:00.000Z
  SNYK-PYTHON-JINJA2-40028:
    - '*':
        reason: >-
          No remediation path available for CKAN2.3 (not compatible with Jinja > 2.6.0). Need to resolve moving to
          CKAN2.8 for catalog (https://github.com/GSA/datagov-ckan-multi/issues/298). Local user needed to exploit
          this issue, current user security enough to make risk acceptable.
        expires: 2021-03-01T06:00:00.000Z
  SNYK-PYTHON-JINJA2-174126:
    - '*':
        reason: >-
          No remediation path available for CKAN2.3 (not compatible with Jinja > 2.6.0). Need to resolve moving to
          CKAN2.8 for catalog (https://github.com/GSA/datagov-ckan-multi/issues/298). Forms for data.gov only
          accessible to government users, risk is acceptable.
        expires: 2021-03-01T06:00:00.000Z
  SNYK-PYTHON-WEBOB-40490:
    - '*':
        reason: >-
          No remediation path available for CKAN2.3 (not compatible with webob > 1.0.8). Need to resolve moving to
          CKAN2.8 for catalog (https://github.com/GSA/datagov-ckan-multi/issues/298)
        expires: 2021-03-01T06:00:00.000Z
  SNYK-PYTHON-PIP-609855:
    - '*':
        reason: >-
          Defunct issue, installed pip is 20.0.2 (confirmed locally and on server systems). Not actually an issue.
        expires: 2021-03-01T06:00:00.000Z
  SNYK-PYTHON-SOLRPY-598893:
    - '*':
        reason: >-
          No remediation path available, and eval function is not used. Upstream uses pysolr, which will resolve 
          the issue.
        expires: 2021-02-23T06:00:00.000Z
  SNYK-PYTHON-URLLIB3-1014645:
    - '*':
        reason: >-
          No remediation path available for CKAN2.3 (not compatible with urllib3 > 1.24). Need to resolve moving to
          CKAN2.8 for catalog (https://github.com/GSA/datagov-ckan-multi/issues/298). `method` parameter is not
          utilized for any user input value, risk is acceptable.
        expires: 2021-02-23T06:00:00.000Z
patch: {}