Skip to content

fix(deps): close all 8 OSV advisories flagged by Scorecard (Vulnerabilities 8 → 10) #372

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Cre-eD merged 1 commit into from
Aug 3, 2026
Merged

fix(deps): close all 8 OSV advisories flagged by Scorecard (Vulnerabilities 8 → 10) #372

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions CODEOWNERS
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,6 +75,16 @@
/go.sum @Cre-eD @smecsia @universe-ops @Laboratory
/tools.go @Cre-eD @smecsia @universe-ops @Laboratory

# ---------------------------------------------------------------------
# Vulnerability-suppression surface. A `not_affected` VEX statement and
# its osv-scanner.toml mirror hide a real advisory from the scanners and
# from OpenSSF Scorecard. That deserves the same review discipline as a
# workflow change, so name the paths explicitly rather than leaning on
# the `*` default.
# ---------------------------------------------------------------------
/vex/ @Cre-eD @smecsia @universe-ops @Laboratory
/osv-scanner.toml @Cre-eD @smecsia @universe-ops @Laboratory

# ---------------------------------------------------------------------
# This policy + ownership file itself.
# ---------------------------------------------------------------------
Expand Down
21 changes: 20 additions & 1 deletion docs/DEPENDENCIES.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,7 +94,10 @@ A subset of findings is intentionally accepted as documented false
positives — those live in PR descriptions and as OpenVEX
`not_affected` statements in [`vex/openvex.json`](../vex/openvex.json),
never in a scanner-suppression file (no `.trivyignore`, no
`# nosemgrep`, no `// nolint:` for vuln findings).
`# nosemgrep`, no `// nolint:` for vuln findings). The single exception
is [`osv-scanner.toml`](../osv-scanner.toml), a derivative mirror of the
VEX statements for OpenSSF Scorecard, which cannot read VEX — see
[Suppressing a finding](#suppressing-a-finding-non-exploitable--false-positive).

## Out-of-tree dependency surface

Expand Down Expand Up @@ -177,6 +180,22 @@ The only sanctioned suppression channel is **VEX**: edit
- `impact_statement` — free-form explanation citing evidence
(e.g., govulncheck output, code-path analysis, mitigation in place)

OpenSSF Scorecard's Vulnerabilities check calls `osv-scanner` directly
and has no VEX input, so a VEX-only `not_affected` still shows up as a
score deduction. For that one consumer the statement is mirrored into
[`osv-scanner.toml`](../osv-scanner.toml) — same advisory ID, the
`reason` field restating the VEX justification. That mirror is the only
scanner-config suppression the project sanctions, and it is derivative:
an entry may exist there **only** when the VEX statement exists first.
`/vex/` and `/osv-scanner.toml` are both code-owned paths so neither
lands without security review.

Every SCA pass re-triages the existing entries in both files. A
`not_affected` whose upstream fix has since shipped gets bumped, flipped
to `status: fixed`, and dropped from the mirror — a suppression that
outlives its justification is not triage. `osv-scanner` reports stale
entries as `unused ignores`, which is the signal to remove them.

`.trivyignore`, `# nosemgrep`, `// nolint:`, `# noqa` are NOT
sanctioned suppression channels. Any of these in a PR must point at
a documented false positive in the PR description; the project
Expand Down
13 changes: 13 additions & 0 deletions docs/requirements.in
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,3 +12,16 @@ mkdocs-mermaid2-plugin~=1.2.3
# chain at docs-build time only.
requests>=2.33.0
urllib3>=2.7.0

# Second Scorecard round (2026-08), same rationale as above:
# - PYSEC-2026-2132 (CVE-2026-7246) - click < 8.3.3
# - GHSA-9xwg-3r6f-jcx2 (CVE-2026-61632) - pymdown-extensions < 11.0.0 (b64 path traversal)
# - PYSEC-2026-3447 (CVE-2026-59890) - setuptools < 83.0.0
# - PYSEC-2026-3071 (CVE-2026-49476) - soupsieve < 2.8.4 (memory exhaustion)
# - PYSEC-2026-3072 (CVE-2026-49477) - soupsieve < 2.8.4 (ReDoS)
# mkdocs-material >=9.7.7 declares `pymdown-extensions>=10.2` with no upper
# bound, so the 11.x major is in-range for the theme.
click>=8.3.3
pymdown-extensions>=11.0.0
setuptools>=83.0.0
soupsieve>=2.8.4
327 changes: 148 additions & 179 deletions docs/requirements.txt
View file
Open in desktop

Large diffs are not rendered by default.

28 changes: 14 additions & 14 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ require (
github.com/MShekow/directory-checksum v1.4.18
github.com/anthonycorbacho/slack-webhook v1.0.1
github.com/antonmedv/expr v1.12.6
github.com/atombender/go-jsonschema v0.23.1
github.com/atombender/go-jsonschema v0.24.1
github.com/aws/aws-lambda-go v1.54.0
github.com/aws/aws-sdk-go-v2 v1.42.0
github.com/aws/aws-sdk-go-v2/config v1.32.25
Expand Down Expand Up @@ -59,17 +59,17 @@ require (
go.mongodb.org/mongo-driver v1.17.9
go.uber.org/atomic v1.11.0
gocloud.dev v0.46.0
golang.org/x/crypto v0.53.0
golang.org/x/crypto v0.54.0
golang.org/x/oauth2 v0.36.0
golang.org/x/sync v0.22.0
golang.org/x/term v0.44.0
golang.org/x/term v0.45.0
golang.org/x/text v0.40.0
google.golang.org/api v0.284.0
gopkg.in/yaml.v2 v2.4.0
gopkg.in/yaml.v3 v3.0.1
k8s.io/apimachinery v0.36.1
k8s.io/client-go v0.36.1
mvdan.cc/gofumpt v0.10.0
mvdan.cc/gofumpt v0.11.0
)

require (
Expand Down Expand Up @@ -103,7 +103,7 @@ require (
github.com/Crocmagnon/fatcontext v0.7.1 // indirect
github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 // indirect
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 // indirect
github.com/Masterminds/semver/v3 v3.4.0 // indirect
Expand Down Expand Up @@ -296,7 +296,7 @@ require (
github.com/kevinburke/ssh_config v1.2.0 // indirect
github.com/kisielk/errcheck v1.9.0 // indirect
github.com/kkHAIKE/contextcheck v1.1.6 // indirect
github.com/klauspost/compress v1.18.4 // indirect
github.com/klauspost/compress v1.18.7 // indirect
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
github.com/kulti/thelper v0.6.3 // indirect
github.com/kunwardeep/paralleltest v1.0.10 // indirect
Expand Down Expand Up @@ -374,7 +374,7 @@ require (
github.com/quasilyte/stdinfo v0.0.0-20220114132959-f7386bf02567 // indirect
github.com/raeperd/recvcheck v0.2.0 // indirect
github.com/rivo/uniseg v0.4.7 // indirect
github.com/rogpeppe/go-internal v1.14.1 // indirect
github.com/rogpeppe/go-internal v1.15.0 // indirect
github.com/rs/zerolog v1.34.0 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/ryancurrah/gomodguard v1.3.5 // indirect
Expand Down Expand Up @@ -443,7 +443,7 @@ require (
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/collector/featuregate v1.59.0 // indirect
go.opentelemetry.io/collector/pdata v1.59.0 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.42.0 // indirect
go.opentelemetry.io/contrib/detectors/gcp v1.43.0 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.67.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.67.0 // indirect
go.opentelemetry.io/otel v1.44.0 // indirect
Expand All @@ -464,17 +464,17 @@ require (
golang.org/x/arch v0.11.0 // indirect
golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect
golang.org/x/exp/typeparams v0.0.0-20250210185358-939b2ce775ac // indirect
golang.org/x/mod v0.37.0 // indirect
golang.org/x/net v0.56.0 // indirect
golang.org/x/sys v0.46.0 // indirect
golang.org/x/telemetry v0.0.0-20260625142307-59b4966ccb57 // indirect
golang.org/x/mod v0.38.0 // indirect
golang.org/x/net v0.57.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/telemetry v0.0.0-20260708182218-49f421fb7959 // indirect
golang.org/x/time v0.15.0 // indirect
golang.org/x/tools v0.47.0 // indirect
golang.org/x/tools v0.48.0 // indirect
golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da // indirect
google.golang.org/genproto v0.0.0-20260319201613-d00831a3d3e7 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260526163538-3dc84a4a5aaa // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
google.golang.org/grpc v1.81.1 // indirect
google.golang.org/grpc v1.82.1 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
Expand Down
Loading
Loading