Skip to content

Suppress unfixable Go stdlib CVEs in ci-tools #95

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
lex57ukr merged 2 commits into from
Mar 21, 2026
Merged

Suppress unfixable Go stdlib CVEs in ci-tools #95

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ad7fac9
Suppress unfixable Go stdlib CVEs in actionlint and yq
lex57ukr Mar 21, 2026
7f91c00
Add "stdlib" to cspell.json words list
lex57ukr Mar 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cspell.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
"shfmt",
"sigstore",
"startswith",
"stdlib",
"stylelint",
"trivy",
"xmlstarlet"
Expand Down
15 changes: 15 additions & 0 deletions images/ci-tools/.trivyignore
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,15 @@
# actionlint v1.7.11 (Go 1.25.7) / yq v4.52.4 (Go 1.26.0)
# Go stdlib CVEs — waiting on upstream releases built with Go >= 1.26.1.
#
# These are lint/formatting tools that run offline against local files.
# Neither tool uses net/url for parsing untrusted URLs or crypto/x509 for
# certificate verification at runtime, so the practical risk is negligible.
# Remove these entries once actionlint and yq ship builds on Go >= 1.26.1.

# net/url: Incorrect parsing of IPv6 host literals (fixed in Go 1.25.8 / 1.26.1)
# Affects: actionlint (Go 1.25.7), yq (Go 1.26.0)
CVE-2026-25679

# crypto/x509: Incorrect enforcement of email constraints (fixed in Go 1.26.1)
# Affects: yq (Go 1.26.0)
CVE-2026-27137
Loading