Weekly scheduled govulncheck (#447 follow-up) #508

Merged

Cordy merged 1 commit from add-vulncheck into main

2026-09-12 17:56:34 +00:00

Cordy commented

2026-09-12 17:53:40 +00:00

Owner

Follow-up to #447: vulncheck.yml, cron Mondays 05:30 UTC (plus manual dispatch).

Runs govulncheck (source mode, reachability) against main.
Fails only on vulnerabilities reachable from our code — the exact condition that produced #447's 26-CVE scanner list. On failure it files an issue with the report (skipped if an open govulncheck issue already exists, so a red week doesn't spam).
A go directive that is merely behind the latest patch with nothing reachable is logged as a notice, not an alarm.
The fix recipe is linked in the filed issue: go get go@patch on a branch, test, release.

Follow-up to #447: `vulncheck.yml`, cron Mondays 05:30 UTC (plus manual dispatch). - Runs govulncheck (source mode, reachability) against main. - **Fails only on vulnerabilities reachable from our code** — the exact condition that produced #447's 26-CVE scanner list. On failure it files an issue with the report (skipped if an open govulncheck issue already exists, so a red week doesn't spam). - A go directive that is merely behind the latest patch with nothing reachable is logged as a notice, not an alarm. - The fix recipe is linked in the filed issue: `go get go@patch` on a branch, test, release.

Cordy added 1 commit

2026-09-12 17:53:41 +00:00