Skip to content

chore(deps): resolve OSV scanner findings #180

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jdomeracki-coder merged 2 commits into from
Sep 16, 2026
+34 −3
Merged

chore(deps): resolve OSV scanner findings #180

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3741ade
chore(deps): resolve OSV scanner findings
jdomeracki-coder Sep 14, 2026
db6b4bb
Merge branch 'main' into fix/osv-scanner-vulnerabilities
jdomeracki-coder Sep 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,7 +174,7 @@ require (
github.com/hdevalence/ed25519consensus v0.1.0 // indirect
github.com/illarion/gonotify v1.0.1 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 // indirect
github.com/insomniacslk/dhcp v0.0.0-20260719225207-c76316d4aa82 // indirect
github.com/invopop/jsonschema v0.14.0 // indirect
github.com/josharian/native v1.1.1-0.20230202152459-5c7d0dd6ab86 // indirect
github.com/jsimonetti/rtnetlink v1.3.5 // indirect
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -544,8 +544,8 @@ github.com/illarion/gonotify v1.0.1 h1:F1d+0Fgbq/sDWjj/r66ekjDG+IDeecQKUFH4wNwso
github.com/illarion/gonotify v1.0.1/go.mod h1:zt5pmDofZpU1f8aqlK0+95eQhoEAn/d4G4B/FjVW4jE=
github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 h1:9K06NfxkBh25x56yVhWWlKFE8YpicaSfHwoV8SFbueA=
github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2/go.mod h1:3A9PQ1cunSDF/1rbTq99Ts4pVnycWg+vlPkfeD2NLFI=
github.com/insomniacslk/dhcp v0.0.0-20260719225207-c76316d4aa82 h1:y5aU8Uvl7eyM5WNgdQvRxbMJb+zo7pD+S72/Yo4pvnQ=
github.com/insomniacslk/dhcp v0.0.0-20260719225207-c76316d4aa82/go.mod h1:qfvBmyDNp+/liLEYWRvqny/PEz9hGe2Dz833eXILSmo=
github.com/invopop/jsonschema v0.14.0 h1:MHQqLhvpNUZfw+hM3AZDYK7jxO8FZoQeQM77g8iyZjg=
github.com/invopop/jsonschema v0.14.0/go.mod h1:ygm6C2EaVNMBDPpaPlnOA2pFAxBnxGjFlMZABxm9n2I=
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
Expand Down
31 changes: 31 additions & 0 deletions osv-scanner.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
[[IgnoredVulns]]
id = "GO-2026-4610"
reason = "The vulnerable Docker CLI plugin search path is Windows-only. Envbox runs on Linux and only uses Docker CLI compose parsing through dockertest."

[[IgnoredVulns]]
id = "GO-2026-4883"
reason = "The vulnerable legacy plugin privilege validation is Docker daemon code. Envbox imports only Docker API types and the client package."

[[IgnoredVulns]]
id = "GO-2026-4887"
reason = "The vulnerable authorization plugin request handling is Docker daemon code. Envbox imports only Docker API types and the client package."

[[IgnoredVulns]]
id = "GO-2026-5617"
reason = "The vulnerable docker cp implementation is Docker daemon code. Envbox imports only Docker API types and the client package."

[[IgnoredVulns]]
id = "GO-2026-5668"
reason = "The vulnerable docker cp implementation is Docker daemon code. Envbox imports only Docker API types and the client package."

[[IgnoredVulns]]
id = "GO-2026-5746"
reason = "The vulnerable archive extraction implementation is Docker daemon code. Envbox imports only Docker API types and the client package."

[[IgnoredVulns]]
id = "GO-2026-5761"
reason = "The vulnerable runc device setup is not used. Envbox reaches runc only through dockertest's homedir package, which imports libcontainer/user."

[[IgnoredVulns]]
id = "GO-2026-5932"
reason = "Envbox uses maintained x/crypto packages such as bcrypt and does not import the vulnerable deprecated openpgp package."
Loading