compose-cli/security/openvex.json at main · PastureStack/compose-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://github.com/PastureStack/compose-cli/security/openvex/2026-08-25",
  "author": "PastureStack contributors",
  "timestamp": "2026-08-25T22:05:55+08:00",
  "version": 1,
  "statements": [
    {
      "vulnerability": {
        "name": "GO-2026-5932"
      },
      "products": [
        {
          "@id": "pkg:golang/golang.org/x/crypto@v0.55.0"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "GO-2026-5932 is limited to the discontinued golang.org/x/crypto/openpgp package. This repository uses maintained bcrypt and scrypt packages through Sprig; the complete vendored package graph and shipped binary contain no openpgp package. Govulncheck reports zero reachable and zero imported-package vulnerabilities."
    }
  ]
}