fix: clear the six OSV advisories behind Scorecard alert 62 by isaacschepp · Pull Request #1262 · genealogix/glx

isaacschepp · 2026-09-18T21:38:25Z

Clears code-scanning alert 62 — the OpenSSF Scorecard Vulnerabilities check, scored 4 on six open OSV advisories.

Five cleared by upgrading

Advisory	CVE	Module	Bump
`GO-2026-6303`	CVE-2026-56854	`golang.org/x/crypto/ssh` — source-address critical option not enforced for non-public-key auth callbacks	`x/crypto` v0.53.0 → v0.56.0
`GO-2026-6354`	CVE-2026-78662	`golang.org/x/crypto/ssh` — DoS on deadlocked undecided channel	same
`GO-2026-6355`	CVE-2026-56855	`golang.org/x/crypto/ssh` — DoS on deadlocked established channel	same
`GO-2026-6179`	CVE-2026-56865	`golang.org/x/mod/sumdb/tlog` — transparency-log tile verification bypass	`x/mod` v0.35.0 → v0.40.0 (`ci-tools`)
`GO-2026-6180`	CVE-2026-56864	`golang.org/x/mod/sumdb` — unrelated unauthenticated hashes honored in `Lookup`	same

The x/crypto bump pulls x/net v0.56.0 → v0.57.0 and x/sys v0.46.0 → v0.47.0 into the root module; the x/mod bump brings x/sync, x/sys, x/telemetry and x/tools along in ci-tools. Both modules stay tidy. No GLX code changed — these are dependency-graph and CI-tooling bumps only.

The sixth: `GO-2026-5932`, suppressed with reasoning

GO-2026-5932 marks golang.org/x/crypto/openpgp unmaintained. It has no fixed version — it is an unmaintained-package advisory, not a patched defect — so no upgrade clears it, and it does not apply to GLX:

golang.org/x/crypto is an indirect dependency reached only through github.com/go-git/go-git/v5, which uses golang.org/x/crypto/hkdf.
go-git's OpenPGP support comes from github.com/ProtonMail/go-crypto/openpgp, the maintained replacement.
go list -deps ./... | grep golang.org/x/crypto/openpgp returns nothing — the package is not in the build graph.
govulncheck agrees: "1 vulnerability in modules you require, but your code doesn't appear to call these vulnerabilities."

Scorecard's check is version-matched rather than reachability-based, so it reports the advisory regardless. A new root osv-scanner.toml ignores that one ID, with the reasoning and the re-verification command recorded inline.

To keep that from being a silent mask, SECURITY-POSTURE.md gains a Vulnerability suppression subsection stating the rule the file operates under — suppress only what upgrading cannot clear and what is provably outside the build graph, every entry carrying its reason and its re-verification command — and the Level 2 Scorecard row now links to it. This matches the document's existing stance on the Pinned-Dependencies ceiling ("no allowlist config masks it").

osv-scanner.toml is added to .reuse/dep5 alongside the other root config files, so reuse lint stays green.

Verification

$ osv-scanner scan source -r .
Loaded filter from: osv-scanner.toml
GO-2026-5932 has been filtered out because: ...
Filtered 1 vulnerability from output
No issues found

$ go tool -modfile=ci-tools/go.mod govulncheck ./...
No vulnerabilities found.
Your code is affected by 0 vulnerabilities.

$ make tidy-check && make ci-tools-tidy-check      # both clean
$ npx markdownlint-cli2 …                          # 0 issues in 0 files
$ pipx run 'reuse[charset-normalizer]' lint        # 994/994 files compliant

go build ./... passes. go test ./... has two pre-existing Windows-only failures on this machine (TestSafeWriteMultiFileArchive/refuses_to_wipe_stale_backup_with_unrecovered_media_binaries asserts a forward-slash path; TestPreflightFileOps_ReportsUnexpectedStatError needs POSIX permissions). Both fail identically on unmodified main at a31becc9, so they are unrelated to this change — CI runs on ubuntu-latest, where they pass.

Scorecard has no pull_request trigger by design, so the alert closes on the next main run after merge rather than on this PR.

🤖 Generated with Claude Code

https://claude.ai/code/session_015KHE6GoBoSwQwQ3mSDMaM7

Scorecard's Vulnerabilities check scored 4 on six advisories. Five are cleared by upgrading: - golang.org/x/crypto v0.53.0 -> v0.56.0 (root module) clears the x/crypto/ssh source-address bypass (GO-2026-6303, CVE-2026-56854) and both deadlocked-channel DoS advisories (GO-2026-6354/CVE-2026-78662, GO-2026-6355/CVE-2026-56855), pulling x/net v0.56.0 -> v0.57.0 and x/sys v0.46.0 -> v0.47.0 with it. - golang.org/x/mod v0.35.0 -> v0.40.0 (ci-tools) clears the sumdb tile verification bypass (GO-2026-6179, CVE-2026-56865) and the unauthenticated-hash Lookup issue (GO-2026-6180, CVE-2026-56864), bringing x/sync, x/sys, x/telemetry and x/tools along. Both modules stay tidy; no GLX code changed. The sixth, GO-2026-5932, has no fixed version -- it marks golang.org/x/crypto/openpgp unmaintained rather than patching a defect -- and does not apply. x/crypto is reached only through go-git, which uses x/crypto/hkdf and gets OpenPGP from ProtonMail/go-crypto/openpgp, so `go list -deps ./...` shows no x/crypto/openpgp package and govulncheck reports it as present-but-uncalled. Scorecard's check is version-matched rather than reachability-based, so a new root osv-scanner.toml ignores that one ID with the reasoning and re-verification command inline, and SECURITY-POSTURE.md gains a "Vulnerability suppression" subsection stating the rule the file operates under. Verified with `osv-scanner scan source -r .` (no issues found), `govulncheck` (0 called), `make tidy-check`, `make ci-tools-tidy-check`, markdownlint and `reuse lint`. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015KHE6GoBoSwQwQ3mSDMaM7 Signed-off-by: isaacschepp <isaac.schepp@gmail.com>

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015KHE6GoBoSwQwQ3mSDMaM7 Signed-off-by: isaacschepp <isaac.schepp@gmail.com>

cloudflare-workers-and-pages · 2026-09-18T21:38:41Z

Deploying genealogix with Cloudflare Pages

Latest commit:	`98e42a1`
Status:	✅ Deploy successful!
Preview URL:	https://6b214eb9.genealogix.pages.dev
Branch Preview URL:	https://fix-osv-vulns-62.genealogix.pages.dev

View logs

Resolves two SECURITY-POSTURE.md conflicts against #1264, which SHA-pinned first-party actions/* and reversed the #1022 convention: - The "GitHub Actions pinned per a documented convention" row takes main's universal-SHA text; this branch's stale pre-#1264 wording is dropped. - The "Continuous security posture scoring" row keeps main's text plus this branch's pointer to the new Vulnerability suppression section. - The Action pinning section keeps main's syft-installer paragraph, followed by this branch's new "Vulnerability suppression" subsection. #1264 removed the accepted Pinned-Dependencies score ceiling, so the suppression section's and changelog entry's cross-reference to it now points at Action pinning's accepted consequence and known limits instead. Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015KHE6GoBoSwQwQ3mSDMaM7

github-actions · 2026-09-18T22:23:54Z

Dependency Review

The following issues were found:

✅ 0 vulnerable package(s)
❌ 5 package(s) with incompatible licenses
✅ 0 package(s) with invalid SPDX license definitions
✅ 0 package(s) with unknown licenses.

See the Details below.

License Issues

ci-tools/go.mod

Package	Version	License	Issue Type
golang.org/x/sync	0.22.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/sys	0.47.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/tools	0.49.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License

go.mod

Package	Version	License	Issue Type
golang.org/x/net	0.57.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License
golang.org/x/sys	0.47.0	BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang	Incompatible License

Allowed Licenses:
Apache-2.0, MIT, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, CC0-1.0, BlueOak-1.0.0, Python-2.0, 0BSD, Unlicense

OpenSSF Scorecard

Package	Version	Score	Details
gomod/golang.org/x/mod	0.40.0	Unknown	Unknown
gomod/golang.org/x/sync	0.22.0	Unknown	Unknown
gomod/golang.org/x/sys	0.47.0	Unknown	Unknown
gomod/golang.org/x/telemetry	0.0.0-20260811182544-a038080d80e5	Unknown	Unknown
gomod/golang.org/x/tools	0.49.0	Unknown	Unknown
gomod/golang.org/x/crypto	0.56.0	Unknown	Unknown
gomod/golang.org/x/net	0.57.0	Unknown	Unknown
gomod/golang.org/x/sys	0.47.0	Unknown	Unknown

Scanned Files

ci-tools/go.mod
go.mod

codecov · 2026-09-18T22:25:13Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

The x/crypto and x/mod bumps in this PR fail Dependency Review's license check: GitHub resolves the bumped golang.org/x/* versions as `BSD-3-Clause AND LicenseRef-scancode-google-patent-license-golang`, and the allow-licenses list from #340 carries `BSD-3-Clause` alone, so the compound expression does not match. The LicenseRef is the Go PATENTS file that ships beside the BSD-3-Clause LICENSE in every golang.org/x module -- an additional patent grant for implementations of Go, terminating only if the user sues over Go patents. It adds a right on top of the copyright license and imposes no obligation on GLX or on downstream consumers, so there is nothing for a review decision to weigh, which is the same reasoning the list already applies to 0BSD and Unlicense. The rationale is recorded inline beside the entry, matching the convention every other license in that list follows. Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com> Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015KHE6GoBoSwQwQ3mSDMaM7

… SARIF (#1341) * ci: Hash-pin PyYAML and apply osv-scanner suppressions to govulncheck SARIF Clears code-scanning alerts 205 and 247. Alert 205 (Scorecard Pinned-Dependencies): issue-templates-drift.yml ran a bare `pip install pyyaml`. It now installs from .github/requirements/issue-templates-drift.txt, which pins pyyaml==6.0.3 to its published sha256 hashes, with `pip install --require-hashes --no-deps`. A Dependabot pip entry for /.github/requirements keeps it current, with the same cooldown as the other ecosystems, and the requirements file joins the workflow's path triggers. Alert 247 (govulncheck GO-2026-5932): the advisory marks golang.org/x/crypto/openpgp unmaintained and has no fixed version, so no x/crypto bump can clear it. GLX does not import the package; osv-scanner.toml already suppresses it for osv-scanner and Scorecard (#1262), but govulncheck has no ignore mechanism and its SARIF still carried it as a module-level note. scripts/filter-govulncheck-sarif.py now drops a SARIF result only when its ID is in osv-scanner.toml AND its level is "note", so one reviewed list governs both scanners, and a suppressed advisory that becomes imported or called is reported again. SECURITY-POSTURE.md documents the filter. Also adds the OpenSSF Best Practices badge (project 15136) to the README, toward alert 59, and removes a truncated duplicate of the #1262 CHANGELOG entry. Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com> * docs: Reference PR #1341 in its CHANGELOG entry Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com> --------- Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com> Signed-off-by: Noah B Johnson <noah@noahbjohnson.net> Co-authored-by: genealogix-ci-bot[bot] <266433663+genealogix-ci-bot[bot]@users.noreply.github.com> Co-authored-by: Noah B Johnson <noah@noahbjohnson.net>

isaacschepp requested a review from noahbjohnson as a code owner September 18, 2026 21:38

docs: reference PR #1262 in the changelog entry

24ff97d

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015KHE6GoBoSwQwQ3mSDMaM7 Signed-off-by: isaacschepp <isaac.schepp@gmail.com>

noahbjohnson previously approved these changes Sep 18, 2026

View reviewed changes

isaacschepp dismissed noahbjohnson’s stale review via f9c5cf1 September 18, 2026 22:23

isaacschepp requested a review from noahbjohnson September 18, 2026 22:23

noahbjohnson approved these changes Sep 18, 2026

View reviewed changes

isaacschepp merged commit a532cce into main Sep 18, 2026
43 checks passed

isaacschepp deleted the fix/osv-vulns-62 branch September 18, 2026 22:40

isaacschepp mentioned this pull request Oct 1, 2026

ci: Hash-pin PyYAML and apply osv-scanner suppressions to govulncheck SARIF #1341

Merged

isaacschepp mentioned this pull request Oct 14, 2026

fix: Correct and bound the GO-2026-5932 osv-scanner suppression #1393

Merged

Navigation Menu

Repository navigation

fix: clear the six OSV advisories behind Scorecard alert 62 - #1262

fix: clear the six OSV advisories behind Scorecard alert 62#1262
isaacschepp merged 4 commits into
mainfrom
fix/osv-vulns-62

isaacschepp commented Sep 18, 2026

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 18, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Sep 18, 2026

Uh oh!

codecov Bot commented Sep 18, 2026

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

isaacschepp commented Sep 18, 2026

Five cleared by upgrading

The sixth: GO-2026-5932, suppressed with reasoning

Verification

Uh oh!

cloudflare-workers-and-pages Bot commented Sep 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying genealogix with Cloudflare Pages

Uh oh!

github-actions Bot commented Sep 18, 2026

Dependency Review

License Issues

ci-tools/go.mod

go.mod

OpenSSF Scorecard

Scanned Files

Uh oh!

codecov Bot commented Sep 18, 2026

Codecov Report

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

The sixth: `GO-2026-5932`, suppressed with reasoning

cloudflare-workers-and-pages Bot commented Sep 18, 2026 •

edited

Loading