Andrew Pollock

icon company OpenSSF icon location Brisbane icon location I'm an independent technologist, with an interest in open source vulnerability management and related software supply chain security

Results 283 comments of Andrew Pollock

Bump requests from 2.25.0 to 2.28.1 in /gcp/appengine

Let's see if we can fix these merge conflicts... @dependabot recreate

Investigate if https://staticcheck.io/ can and should be added to the Go code checks

@another-rex also mentioned https://golangci-lint.run/usage/linters/

Investigate if https://staticcheck.io/ can and should be added to the Go code checks

Also related: https://github.com/golang/vuln/blob/master/checks.bash

Fix API documentation

Possibly also related: #809?

vulnfeeds: detect when version range has introduced > fixed

To help with prioritisation, does this code get used by anything currently?

vulnfeeds: detect when version range has introduced > fixed

This is blocked on there being Go code to do Python version comparison

[WIP] Errors in running test suite

Worker tests look pretty good as of today. There's some GCP auth dependencies (GCS bucket related) that we need to remove, possibly by making them public.

Add kubernetes vulnerabilities

https://github.com/kubernetes/enhancements/issues/3203 also seems to be related to this.

Add kubernetes vulnerabilities

We're currently updating our roadmap for 2023, and have tentatively targeted Q3 for this, subject to the data being available.

Add Dart vulnerabilities

Hi, We get these (now) by virtue of them being included in GitHub Security Advisories. c.f. https://osv.dev/list?ecosystem=Pub&q=