#170 added osv-scanner.toml ignoring GO-2026-5932: golang.org/x/crypto/openpgp is unmaintained/unsafe by design and has no fixed version, so upgrading x/crypto can never clear it. It reaches us transitively through test-only dependencies (testcontainers chain) and cel2sql never calls it — govulncheck confirms no affected call path.
Work
- Periodically check whether the transitive dependency drops the openpgp import (e.g. moves to ProtonMail/go-crypto), then remove the ignore
- If more unfixable advisories accumulate, consider documenting the ignore policy in CONTRIBUTING/SECURITY docs
#170 added
osv-scanner.tomlignoring GO-2026-5932:golang.org/x/crypto/openpgpis unmaintained/unsafe by design and has no fixed version, so upgrading x/crypto can never clear it. It reaches us transitively through test-only dependencies (testcontainers chain) and cel2sql never calls it — govulncheck confirms no affected call path.Work