Skip to content

Renew the GO-2026-5932 exception, unbreaking master #258

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LouisParkin merged 1 commit into from
Aug 12, 2026
Merged

Renew the GO-2026-5932 exception, unbreaking master #258

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 9 additions & 1 deletion exceptions/GO-2026-5932.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ component:
- opt/stackstate-agent/bin/agent/process-agent
status: accepted_with_compensating_control
reason: unpublished_image_vex_identity_bridge
expires: 2026-08-11
expires: 2026-08-26
owner: "@StackVista/observability-team"
upstream_owner: golang
upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932
Expand All @@ -24,3 +24,11 @@ statement: |
VEX hub in advance. Keep this bridge only until the scan pipeline can apply
the reviewed statement to unpublished images without broadening it to every
consumer of golang.org/x/crypto.

Renewed 2026-08-12. No compatible patch exists: the advisory covers all
versions (introduced 0, no fixed release) because the openpgp packages are
permanently unmaintained, so upgrading golang.org/x/crypto cannot clear it.
Absence re-verified against this commit with `go list -deps ./cmd/...`, which
resolves 1329 packages and no openpgp package; the only linked x/crypto
packages are cryptobyte, chacha20, chacha20poly1305, pbkdf2, scrypt and ocsp,
which are also why the indirect module cannot simply be dropped.
Loading