.safety-policy-develop.yml

# Safety policy file for packages needed for development.
# For documentation, see https://docs.pyup.io/docs/safety-20-policy-file

# Note: This policy file is used against the versions in minimum-constraints.txt
# That file includes minimum-constraints-install.txt with '-c'. Since that is
# not supported and ignored by the safety tool, this policy file ends up being
# checked just against the minimum versions for development, without install.
# That's ok since the 'install' safety profile checks the install packages.

# Configuration for the 'safety check' command
security:

    # Ignore certain severities.
    # A number between 0 and 10, with the following significant values:
    # - 9: ignore all vulnerabilities except CRITICAL severity
    # - 7: ignore all vulnerabilities except CRITICAL & HIGH severity
    # - 4: ignore all vulnerabilities except CRITICAL, HIGH & MEDIUM severity
    ignore-cvss-severity-below: 0

    # Ignore unknown severities.
    # Should be set to False.
    ignore-cvss-unknown-severity: False

    # Ignore unpinned requirements.
    # Should be set to False.
    ignore-unpinned-requirements: False

    # List of specific vulnerabilities to ignore.
    # {id}:                 # vulnerability ID
    #     reason: {text}    # optional: Reason for ignoring it. Will be reported in the Safety reports
    #     expires: {date}   # optional: Date when this ignore will expire
    ignore-vulnerabilities:
        70612:
            reason: Disputed issue in Jinja2 version 3.1.3 - No known fix

    # Continue with exit code 0 when vulnerabilities are found.
    continue-on-vulnerability-error: False