Drop all pgx and docker/docker vuln suppressions#805
Merged
Conversation
The `GO-2026-4771` and `GO-2026-4772` (`CVE-2026-33815`/`33816`) ignore entries were added when no fix for `github.com/jackc/pgx/v5` existed. The fix shipped in `pgx/v5 v5.9.0` and this project is already on `v5.9.2`, so the advisories no longer apply and govulncheck does not report them — the suppressions are dead weight. Also refresh the retained `docker/docker` justifications (`GO-2026-4883`/`4887`) to state accurately that the module is deprecated as of Docker v29 and the remediation is the upstream migration to `github.com/moby/moby/{client,api}` (stacklok/toolhive#5420), not a `docker/docker` release that will never come. Those entries stay because `docker/docker` is still reachable here transitively via `migrate` and `ory/x`. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #805 +/- ##
==========================================
- Coverage 61.79% 61.77% -0.02%
==========================================
Files 109 109
Lines 10556 10556
==========================================
- Hits 6523 6521 -2
- Misses 3453 3454 +1
- Partials 580 581 +1 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
JAORMX
previously approved these changes
Jun 3, 2026
Drop the `GO-2026-4883` / `GO-2026-4887` entries from the govulncheck `IGNORED_VULNS` list and the matching `GHSA-x744-4wpc-v9h2` / `CVE-2026-34040` ignore block from `.grype.yaml`. These are Docker daemon advisories (plugin privilege off-by-one and AuthZ bypass) that this client-only consumer reaches solely through toolhive's transitive `github.com/docker/docker` import; the daemon-side vulnerable paths are unreachable here. `github.com/docker/docker` is frozen at `v28.5.2` with no fixed release, so there is nothing to bump to. The remediation is the upstream `docker/docker` -> `github.com/moby/moby/{client,api}` migration (toolhive#5420); once that lands and toolhive is bumped, the advisories leave the dependency graph and both scanners go green. The suppressions are removed now so the advisories surface rather than stay masked. Both Security Scan jobs are required status checks and will fail until that bump merges. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
rdimitrov
changed the title
pgx govulncheck suppressions
rdimitrov
changed the title
pgx and docker/docker vuln suppressions
JAORMX
approved these changes
Jun 3, 2026
rdimitrov
added a commit
that referenced
this pull request
Jun 3, 2026
## Summary
Bumps `github.com/stacklok/toolhive` **v0.28.3 → v0.29.0**, which
removes `github.com/docker/docker` from this project's build.
v0.29.0 migrates toolhive's container runtime off the **deprecated,
frozen** `docker/docker` module onto the maintained
`github.com/moby/moby/{client,api}` modules (stacklok/toolhive#5420).
With that, nothing in registry-server's import graph pulls
`docker/docker` anymore, so it drops out of the production build and
`go.mod` entirely (it remains only as an indirect `go.sum` checksum via
the module graph).
This **completes** the remediation that #805 set up: #805 removed the
`GO-2026-4883` / `GO-2026-4887` (`CVE-2026-33997` / `CVE-2026-34040`)
docker daemon-advisory suppressions ahead of this bump (with a note that
the scans were expected to fail until it landed). This is that bump.
## Verification (local)
- `go build ./...` ✓, `go vet ./...` ✓ — no breaking changes from the
minor bump
- `docker/docker` in production build: **0 packages**; `go mod why` →
"main module does not need package"; gone from `go.mod`
- **Grype** (`--only-fixed --fail-on high`, matching CI): no
`docker/docker` / high+fixed findings → exit 0 — the Grype Repository
Scan will pass
- govulncheck: no `docker/docker` findings (the advisories are off the
build)
- Refreshed the now-satisfied "until the bump lands" notes in
`security-scan.yml` and `.grype.yaml`
## Note on the `Go Vulnerability Check` job
It will likely **stay red on the pre-existing stdlib batch**
`GO-2026-5037/5038/5039` (`crypto/x509`, `mime`, `net/textproto`; fixed
in **Go 1.26.4**), reached via this project's own code. That's unrelated
to this bump — it's red on `main` for the same reason, pending CI's Go
toolchain reaching 1.26.4 (the Actions `go-versions` manifest still tops
out at 1.26.3). This PR only removes the **docker** advisories from the
reported set.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
1 task
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Removes all govulncheck and grype vuln suppressions from the repo. After this PR there are no active ignore entries in
.github/workflows/security-scan.yml(IGNORED_VULNS="") or.grype.yaml(ignore: []).Dropped (stale):
GO-2026-4771/GO-2026-4772(pgx pgproto3 decode)These were added when no fix for
github.com/jackc/pgx/v5existed. The fix shipped inpgx/v5 v5.9.0, and this project is already onv5.9.2— so the advisories no longer apply, the version isn't in the affected range, and govulncheck doesn't report them. Removing them does not change which vulnerabilities are reported (they were never in the found/called set).Dropped (intentionally surfaced):
GO-2026-4883/GO-2026-4887(docker daemon)Also removes the
GHSA-x744-4wpc-v9h2/CVE-2026-34040block from.grype.yaml.These are Docker daemon advisories (plugin privilege off-by-one and AuthZ bypass). This client-only consumer reaches
github.com/docker/dockersolely through toolhive's transitive import — the daemon-side vulnerable paths are unreachable here.github.com/docker/dockeris frozen atv28.5.2with no fixed release, so there is nothing to bump to; the real remediation is the upstreamdocker/docker→github.com/moby/moby/{client,api}migration (stacklok/toolhive#5420).Rather than keep these masked, we remove the suppressions now so the advisories surface. Once the moby-migrated toolhive is bumped here,
docker/dockerleaves the dependency graph and both scanners go green again — at which point no follow-up cleanup is needed because the ignore entries are already gone.Both
Security Scan / Go Vulnerability CheckandSecurity Scan / Grype Repository Scanare required status checks and will be red on this PR until the toolhive/moby bump lands:GHSA-x744-4wpc-v9h2(docker/docker@v28.5.2, High, fix29.3.1).GO-2026-4883/GO-2026-4887(docker), plus transiently onGO-2026-5037/5038/5039(stdlib, until CI'sstabletoolchain reachesgo1.26.4).Merging therefore requires an admin bypass, and downstream PRs cut from
mainwill inherit the same red required checks until the bump merges.Notes
🤖 Generated with Claude Code