Dismissing Dependabot Alerts Redux

30 Aug 2026 in Development, Github

Sometimes context is missed in security updates; never mind

I’ve been running my new dismiss-alerts workflow in my personal projects for a while now, and it’s working well enough. However, recently there have been a spate of security alerts for things that I genuinely don’t have control over and also I can immediately see have no relevance to me. A case in point here is the Apache HTTP vulnerabilities that are transient from the AWS Java SDK; they were reported on by dependabot in my aws-kms-csr project which is essentially a one-shot commandline tool wrapped by gradle to create a CSR using your AWS KMS keys.

Yes, it’s a vulnerability, but equally it’s not one that I need hanging over me like some unexploded WWII ordnance. It’s a tolerable risk for this project because of what the project is and how it manifests itself; your own tolerance may vary.

I was bored of actually having to construct the dismiss-alerts.yml file manually so I wrote a script to auto-generate updates to the file that will ultimately dismiss those alerts. This is a convenience tool for me, I do actually read all the security alerts because I’m interested in that sort of thing, but life is a bit too short to do more typing than you need to. This re-uses an extension I use quite heavily, so it’s just a case of joining the tools up with yq doing the heavy lifting for me. This leaves me with a modified dismiss-alerts.yml that I can just checkin and carry on with my day.

#!/usr/bin/env bash
# shellcheck disable=SC1083

set -eo pipefail
tmp_file=$(mktemp)
trap 'rm -f "$tmp_file"' EXIT
gh my vulns -j \
  | grep -F 'aws-kms-csr' \
  | yq ea -p=json -o=yaml '
    . as $item ireduce ({};
      .[($item.CVE // $item.GHSA)].packages += [$item.package] |
      .[($item.CVE // $item.GHSA)].reason = "tolerable_risk" |
      .[($item.CVE // $item.GHSA)].comment = "Commandline one-shot tool; you are in control" |
      .[($item.CVE // $item.GHSA)].commentary = "autogenerated via just suppress-vulns"
    )
  ' - \
  | yq -o=yaml 'with_entries(.value.packages |= unique)' > "$tmp_file"
yq ea -i '
  select(fileIndex == 0) *+ select(fileIndex == 1) |
  with_entries(.value.packages |= unique)
' .github/dismiss-alerts.yml "$tmp_file"