internal/report: adds SkipFix field to Package

New SkipFix field on report.Package indicates that a package
should not be automatically updated by vulnreport fix.

vulnreport fix now automatically adds a todo message if this
field and Module.VulnerableAt are both empty.

Lint rules will come later.

Change-Id: I574539362cf334cdc9fee59f036e1de8e5b5bd6e
Reviewed-on: https://go-review.googlesource.com/c/vulndb/+/464016
Reviewed-by: Tatiana Bradley <tatianabradley@google.com>
Run-TryBot: Tim King <taking@google.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
3 files changed
tree: 109f32fb91f12d0c150837dc918b08cd44704818
  1. .github/
  2. cmd/
  3. data/
  4. deploy/
  5. devtools/
  6. doc/
  7. internal/
  8. terraform/
  9. webconfig/
  10. .gitignore
  11. all_test.go
  12. checks.bash
  13. CONTRIBUTING.md
  14. go.mod
  15. go.sum
  16. LICENSE
  17. PATENTS
  18. README.md
  19. tools_test.go
README.md

The Go Vulnerability Database

Go Reference

This repository contains the infrastructure and internal reports to create the Go Vulnerability Database.

If you are interested accessing data from the Go Vulnerability Database, see x/vuln.

Check out https://go.dev/security/vuln for more information about the Go vulnerability management system.

Reporting a vulnerability or feedback

Click here to report a public vulnerability in the Go ecosystem, or give feedback about the project.

Privacy Policy

The privacy policy for govulncheck can be found at https://vuln.go.dev/privacy.

License

Unless otherwise noted, the Go source files are distributed under the BSD-style license found in the LICENSE file.

Database entries are distributed under the terms of the CC-BY-4.0 license. See x/vuln for information on how to access these entries.