yaooqinn commented on code in PR #4266:
URL: https://github.com/apache/kyuubi/pull/4266#discussion_r1100968854
##########
.github/workflows/dep.yml:
##########
@@ -57,3 +58,7 @@ jobs:
-pl kyuubi-ctl,kyuubi-server,kyuubi-assembly -am
- name: Check dependency list
run: build/dependency.sh
+ - name: Dependency Review
+ uses: actions/dependency-review-action@v3
+ with:
+ fail-on-severity: low
Review Comment:
The risk for vulnerability is determined by the CVSS score. If you go to
check the mvn central or NVD, it's common to see an artifact have some
low-level vulnerabilities. I guess it is not practical for us to add such a
critical rule that blocks PRs frequently
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
