Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

enable Dependabot v2 #126

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Conversation

sullis
Copy link

@sullis sullis commented Feb 14, 2021

@rohanpadhye
Copy link
Owner

Thanks! Is there any way to ignore checks for the examples module? This module specifically points to old sometimes buggy versions for testing. We want to be able to use JQF to reproduce discovering previously known bugs from these old versions (e.g. the Closure Compiler tutorial). This module is not used by jqf-fuzz or jqf-maven-plugin so clients need not worry about pulling vulnerable dependencies when they use JQF externally.

The dependabot doc describes ignore, but that seems to be aimed at specific dependencies, not modules within the repository. An alternative would simply be to have three different directory entries in the dependabot.yml for each of fuzz, instrument, and maven-plugin.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants