Ask about the expiration time of the CVE whitelists

[hyeyoung-leee]

Hi,

I am inquiring about the expiration time of the CVE whitelists.
Harbor version is Version v2.5.3-797c3536.

I set the system wide CVE whitelists and expiration time to pull image with vulnerability. And I do not set per-project CVE whitelists and expiration time.
It seems that the whitelist is applied even after the expiration time has passed. Please check if this is the correct operation or a bug.

If this is the correct operation, shouldn't the whitelist be allowed after the expiration time?

Thanks.

[stonezdj]

see #18078