Merge 6d8cb8a into 33d7e5d

MozillaFoundation · Jul 11, 2018 · fd4d703 · fd4d703
2 parents 33d7e5d + 6d8cb8a
commit fd4d703
Show file tree

Hide file tree

Showing 3 changed files with 22 additions and 2,910 deletions.
diff --git a/Pipfile.lock b/Pipfile.lock
diff --git a/README.md b/README.md
@@ -259,5 +259,4 @@ The URL for fetching static content from the Network API can be customized by sp
 If an issue is reported by Snyk, you have several options to remedy the problem. Firstly, the build log should contain a link to the vulnerability report on snyk.io. On that page you will find links to the issue or CVE, and information about how to resolve the problem. You should start a new feature branch and pull request to resolve this issue before merging any other features.
 
 #### Unpatched vulnerabilities
-
 In some cases, vulnerabilities have not been patched - you will need to look at the nature of the issue and then add an exception to the `.snyk` file for it. You can install the snyk cli using `npm install -g snyk` and add the exception like so: `snyk ignore --id="SNYK-PYTHON-BOTO3-40617" --expiry="2017-12-31" --reason="No fix available"` (Replace the `id` and `reason` with relevant information). The `expiry` flag is an [RFC2822](https://tools.ietf.org/html/rfc2822#page-14) formatted date string that will cause the ignore rule to expire - useful so that we can check periodically for fixes to unpatched vulnerabilities in our dependencies.