docs: correct v0.8.0 security notes for toolchain-dependent counts - #57
Merged
Conversation
The v0.8.0 Security section quoted a raw govulncheck count ("drop from 34
vulnerabilities across 4 modules to 25") without naming the toolchain that
produced it. That number was measured under go1.25.0. Under go1.25.13 the
same tree reports 0 called vulnerabilities, and a re-scan under go1.25.0
today reports 29 rather than 25 because the advisory database has grown --
the figure was never stable and never described this repository's
dependencies.
Quoting it unqualified understates the dependency work (which did eliminate
two real advisories, GO-2026-5932 and GO-2025-3922) and implies 25
outstanding problems that do not exist for users: CI and the release
pipeline build with a floating go-version "1.25", so published binaries
already carry the patched standard library.
Editing an already-released section departs from Keep a Changelog
immutability. The same exception was taken for the v0.7.0 profile-path
migration note: where a released entry would actively mislead a reader
about the state of the software, correcting it in place is preferable to
leaving the wrong statement standing and appending a contradiction
elsewhere. No released behaviour is being rewritten -- only the accuracy of
the description of it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Rewrites the last two bullets of the released
[0.8.0]Security section so the govulncheck claims are toolchain-aware.The old text quoted "findings drop from 34 vulnerabilities across 4 modules to 25". That was measured under go1.25.0. It is misleading:
go-version: "1.25", so shipped binaries already build against the patched stdlib.The new text names the two advisories the dependency work actually eliminated (GO-2026-5932 via the
minio/selfupdateswap, GO-2025-3922 via the same dependency tail), qualifies every count with its toolchain, and lists the two non-called residuals under go1.25.13 (GO-2026-5942 innet, fixed only innet@go1.26.6; GO-2026-5932 as a module-graph-only entry).Amending a released section
Deliberate exception to Keep a Changelog immutability, same as the v0.7.0 profile-path migration note — a released entry that actively misleads is better corrected in place than left standing with a contradiction appended elsewhere. No released behaviour is rewritten, only the description of it. Rationale is in the commit body.
Verification
go1.25.13 run golang.org/x/vuln/cmd/govulncheck@latest ./...→ 0 called, 1 imported-not-called, 1 module-onlygovulncheck ./...under go1.25.0 → 29 called, all stdlibmake lintclean,make buildcleangh release view v0.8.0— release notes are GoReleaser commit-generated and do not contain the stale wording, so no published release edit is needed