[AWS] Suppress NuGet audit warning#3677
Conversation
Suppress low severity audit warning for GHSA-9cvc-h2w8-phrp to fix build.
github-actions
Bot
added
the
comp:instrumentation.aws
Suppress low severity audit warning for GHSA-9cvc-h2w8-phrp to fix build.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #3677 +/- ##
==========================================
+ Coverage 71.58% 71.72% +0.13%
==========================================
Files 455 445 -10
Lines 17700 17649 -51
==========================================
- Hits 12670 12658 -12
+ Misses 5030 4991 -39
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
I would go with update minimal package version if the AWS is fine with such changes. |
|
Doesn't appear to work when PR moves out of draft... |
|
/cc @srprash @normj @lukeina2z |
There was a problem hiding this comment.
Pull request overview
This PR suppresses a low-severity NuGet audit warning (GHSA-9cvc-h2w8-phrp) to fix a build error in the AWS instrumentation package and related test app. The warning is related to AWSSDK packages with versions in the range [4.0.0, 5.0.0).
Changes:
- Added NuGetAuditSuppress entries for the GHSA-9cvc-h2w8-phrp security advisory in two project files
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| src/OpenTelemetry.Instrumentation.AWS/OpenTelemetry.Instrumentation.AWS.csproj | Added NuGet audit suppression for GHSA-9cvc-h2w8-phrp to allow building with AWSSDK packages v4.0.0+ |
| test/OpenTelemetry.AotCompatibility.TestApp/OpenTelemetry.AotCompatibility.TestApp.csproj | Added NuGet audit suppression for GHSA-9cvc-h2w8-phrp for the AOT compatibility test app that references AWS instrumentation |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
@Kielek Given it's a low severity, should we merge this as-is to unblock CI and we can bump the version and remove the suppression in a follow-up if that's what the maintainers would rather do? |
Kielek
left a comment
Kielek
left a comment
There was a problem hiding this comment.
@martincostello, lets do this.
Changes
Suppress low severity audit warning for GHSA-9cvc-h2w8-phrp to fix build error.
Alternatively, we need to bump from
[4.0.0, 5.0.0)to[4.0.3.3, 5.0.0).Merge requirement checklist
Unit tests added/updatedAppropriateCHANGELOG.mdfiles updated for non-trivial changesChanges in public API reviewed (if applicable)