Checklist
Safety version
3.7.0
Python version
3.12
Operating System
macOS 15
Feature description
In the 3.0 policy file format, the expires attribute on ignored vulnerabilities is mandatory. It was optional in the 2.0 policy file format.
There are vulnerabilities that need to be ignored forever. In our case, that is nearly all of the vulnerabilities, because we fix vulnerabilities even if we are not affected by them. That leaves only two types of vulnerabilities:
- those that have no fix (for which expires is reasonable to have)
- those that need to be ignored because the fixed version of the package requires a higher Python version than our own package does.
Nearly all of our ignored vulnerabilities are of the last category. For that category, it does not make sense to regularly recheck whether a fixed version of the package now added the lower Python version, because that never happens.
The circumvention right now is to specify a fantasy expiration date sometimes in the future, but I would much prefer if the "expires" attribute would be optional and defaulted to "never", like it did in the version 2.0 file format.
Alternatives and current workarounds
No response
Additional context
No response
Checklist
Safety version
3.7.0
Python version
3.12
Operating System
macOS 15
Feature description
In the 3.0 policy file format, the
expiresattribute on ignored vulnerabilities is mandatory. It was optional in the 2.0 policy file format.There are vulnerabilities that need to be ignored forever. In our case, that is nearly all of the vulnerabilities, because we fix vulnerabilities even if we are not affected by them. That leaves only two types of vulnerabilities:
Nearly all of our ignored vulnerabilities are of the last category. For that category, it does not make sense to regularly recheck whether a fixed version of the package now added the lower Python version, because that never happens.
The circumvention right now is to specify a fantasy expiration date sometimes in the future, but I would much prefer if the "expires" attribute would be optional and defaulted to "never", like it did in the version 2.0 file format.
Alternatives and current workarounds
No response
Additional context
No response