Renew the GO-2026-5932 exception, unbreaking master - #258
Merged
Conversation
The exception expired on 2026-08-11, so the first master build after that date failed its image scan gate on an expired exception rather than on any new finding. The commit it failed on only added a workflow file. No compatible patch exists to remediate instead: the advisory covers every version of golang.org/x/crypto (introduced 0, no fixed release) because the openpgp packages are permanently unmaintained, so a bump cannot clear it. Re-verified the not-affected claim against this commit rather than trusting the original text. go list -deps ./cmd/... resolves 1329 packages and contains no openpgp package; the linked x/crypto packages are cryptobyte, chacha20, chacha20poly1305, pbkdf2, scrypt and ocsp, which are also why the indirect module cannot be dropped. Renewed for the 14 days the SLA allows a finding with no known patch. The durable fix is a vexhub statement, tracked in StackVista/cve-reporter#27. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
LukaszMarchewka
approved these changes
Aug 12, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
master has been red since 05:46 today. The image scan gate failed on an expired exception, not a new finding —
exceptions/GO-2026-5932.yamllapsed on 2026-08-11:The commit it failed on (732e8b4b) only added a workflow file, and the previous master build was green.
Why renew rather than patch: there is nothing to patch to. The advisory covers every version of
golang.org/x/crypto(introduced: 0, nofixedrelease) because theopenpgppackages are permanently unmaintained — v0.55.0 is flagged identically.Re-verified the not-affected claim against this commit rather than trusting the original text:
go list -deps ./cmd/...resolves 1329 packages and contains noopenpgppackage. The only linkedx/cryptopackages arecryptobyte,chacha20,chacha20poly1305,pbkdf2,scryptandocsp— which is also why the indirect module can't just be dropped. The scanner flags it because Go binaries embed the full module list in BuildInfo, so matching is module-level, not package-level.Renewed to 2026-08-26 — the 14 days the CVE Remediation SLA allows for a finding with no known compatible patch.
The durable fix is a vexhub statement replacing this local exception, tracked in StackVista/cve-reporter#27. Worth knowing:
argocd-cmpando11y-toolingcarry the same exception, expired 2026-07-24, and both already have a red default branch from this same cause.