From 2066ee3547b5b410e3379432df239615f8761125 Mon Sep 17 00:00:00 2001 From: Tim Schindler Date: Fri, 14 Aug 2026 07:03:06 +0200 Subject: [PATCH] docs: correct v0.8.0 security notes for toolchain-dependent counts The v0.8.0 Security section quoted a raw govulncheck count ("drop from 34 vulnerabilities across 4 modules to 25") without naming the toolchain that produced it. That number was measured under go1.25.0. Under go1.25.13 the same tree reports 0 called vulnerabilities, and a re-scan under go1.25.0 today reports 29 rather than 25 because the advisory database has grown -- the figure was never stable and never described this repository's dependencies. Quoting it unqualified understates the dependency work (which did eliminate two real advisories, GO-2026-5932 and GO-2025-3922) and implies 25 outstanding problems that do not exist for users: CI and the release pipeline build with a floating go-version "1.25", so published binaries already carry the patched standard library. Editing an already-released section departs from Keep a Changelog immutability. The same exception was taken for the v0.7.0 profile-path migration note: where a released entry would actively mislead a reader about the state of the software, correcting it in place is preferable to leaving the wrong statement standing and appending a contradiction elsewhere. No released behaviour is being rewritten -- only the accuracy of the description of it. --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index dd0e42e..bec8b07 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -46,8 +46,8 @@ All notable changes to this project will be documented in this file. - `grant update` now verifies the downloaded archive's SHA-256 against the release's `checksums.txt` before replacing the binary. Previously no validation was performed at all (`selfupdate.DefaultUpdater()` ships a nil `Validator`). Note the trust model: `checksums.txt` is fetched from the same origin as the archive, so this protects against corrupted or tampered downloads in transit, not against a compromised GitHub account or release pipeline - Archive extraction now rejects oversized entries instead of silently truncating them at the 128 MiB cap, rejects drive-absolute (`C:\...`) and UNC archive paths alongside `..` traversal, and only accepts the binary at the archive root (never a nested entry, never two candidates) -- Removes `golang.org/x/crypto/openpgp` from the build graph, clearing advisory GO-2026-5932 (unmaintained package, no fix available). Dropping `ulikunitz/xz` also clears GO-2025-3922 -- `govulncheck` findings drop from 34 vulnerabilities across 4 modules to 25, all of which are Go standard library issues fixed in go1.25.x patch releases. No third-party module in the build graph has a called vulnerability +- Clears two dependency advisories. Replacing `rhysd/go-github-selfupdate` with `minio/selfupdate` removes `golang.org/x/crypto/openpgp` from the build graph, clearing GO-2026-5932 (unmaintained package, no fix available); dropping `ulikunitz/xz` with the same dependency tail clears GO-2025-3922. No third-party module in the build graph has a called vulnerability +- The `govulncheck` findings that remained at release time were Go standard library issues, not dependency issues, and the count is a property of the scanning toolchain rather than of this tree. Scanned with go1.25.0 the release tree reports called stdlib vulnerabilities (34 at the time this section was first written, 29 on a re-scan on 2026-08-14 as the advisory database grew); scanned with go1.25.13 it reports **0 called vulnerabilities**. CI and the release pipeline pin a floating `go-version: "1.25"`, so published binaries are built against the current patched standard library. The only residuals under go1.25.13 are not called: GO-2026-5942 (`net` SVCB/HTTPS RR parsing panic, fixed in `net@go1.26.6`, with no Go 1.25 patch available) and GO-2026-5932, which lingers as a module-graph entry outside the build graph ## [0.7.0] - 2026-04-21