Suppress Findings

[stealthrabbi]

Is it possible to suppress an EOL finding? For example, xeol is indicating that the EOL for spring-boot is coming. THere's no newer version to upgrade to, so i want to suppress this. Is that possible? I do not see any documentation on what the configuration file can take.

NAME         VERSION  EOL         DAYS EOL  TYPE         
spring-boot  3.1.5    2024-05-18  100       java-archive
1 error occurred:
        * discovered EOL packages
        ```

[noqcks]

this is a good idea. since we dont have a CVE or other stable ID like a vulnerability scanner, we could hijack our fingerprinting logic to use in suppressing findings

https://github.com/xeol-io/xeol/blob/main/xeol/match/fingerprint.go

[stealthrabbi]

Thanks. Just to be clear, this is a capability not possible in xeol currently?

[noqcks]

Nope, not currently possible

[stealthrabbi]

Any chance of suppressions being added soon? I'm runnign in to issues where the endolife data source has version of React < 19 as being end of life, but I don't think that's actually true in reality.