docs(security): refresh multi-scanner CVE reports after #70

[cursor]

Summary

Post-merge CVE automation refresh after PR #70 (v3.1.2 tied db_lookup score_cutoff).

Scanners run

Trivy, Grype, Syft, osv-scanner, Dockle, Dive against poetry.lock / proxy image python:3.13-slim-bookworm. Snyk and Docker Scout skipped (no SNYK_TOKEN / Docker Hub login).

Easy pyproject.toml fixes

None available. osv-scanner reports "0 vulnerabilities can be fixed". The #69 datasets ^5.0.1 bump already remediated CVE-2026-66007 on main. Remaining locked-graph finding is diskcache==5.6.3 / CVE-2025-69872 with no PyPI patch.

This PR

• Refresh tracked HTML: security/reports/cve-report.html, security/reports/human-review.html
• Bump OpenVEX to version 7 and re-validate diskcache not_affected after fix: v3.1.2 — keep tied db_lookup candidates when score_cutoff floors (fix-46z) #70
• Human-review recommendations remain IGNORE for diskcache (no upstream fix; VEX justification), proxy-image OS CVEs (not product), and Dockle CIS findings (proxy image only)

Test plan

• Trivy/Grype clean with OpenVEX
• osv-scanner / pip-audit confirm only diskcache, unfixed
• PyPI diskcache latest still 5.6.3

  

Summary by Sourcery

Refresh security reports and OpenVEX assessments to reflect the post-PR #70 vulnerability scan, with no new dependency remediation required.

Enhancements:

• Refresh the multi-scanner CVE and human-review reports after PR fix: v3.1.2 — keep tied db_lookup candidates when score_cutoff floors (fix-46z) #70, confirming that the remaining diskcache advisory has no available package fix and remains out of product scope.
• Re-validate the diskcache not-affected assessment with the updated OpenVEX record and preserve IGNORE recommendations for non-product proxy-image findings.

Documentation:

• Update the tracked CVE and human-review HTML reports with current scanner results, remediation status, and security assessment rationale.

Tests:

• Reconfirm scanner results across the locked dependency graph and proxy image, including the absence of additional fixable Python vulnerabilities.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Post-merge security documentation refresh after PR #70: regenerates the multi-scanner CVE and human-review HTML reports to reflect the latest scan run, clarifies that no new pyproject.toml upgrades are available beyond the prior datasets bump, and updates the OpenVEX manifest to version 7 while reaffirming the diskcache not_affected assessment.

Flow diagram for updated multi-scanner CVE reporting with OpenVEX v7

flowchart LR
    Syft["Syft SBOM from poetry.lock"]
    Trivy["Trivy scan"]
    Grype["Grype scan"]
    OSV["osv-scanner"]
    PipAudit["pip-audit"]

    OpenVEX["OpenVEX manifest v7 (diskcache not_affected)"]
    Filtered["Post-VEX filtered findings"]
    HTML_CVE["cve-report.html"]
    HTML_HR["human-review.html"]
    EasyBumps{"Any easy pyproject.toml bumps?"}

    Syft --> Trivy
    Syft --> Grype
    Syft --> OSV

    Trivy --> OpenVEX
    Grype --> OpenVEX
    OSV --> OpenVEX
    PipAudit --> OpenVEX

    OpenVEX --> Filtered
    Filtered --> EasyBumps

    EasyBumps -- "No (datasets already ^5.0.1; diskcache unfixed)" --> HTML_CVE
    EasyBumps -- "Document IGNORE rationale" --> HTML_HR

Loading

File-Level Changes

Change	Details	Files
Regenerated CVE report HTML to reflect the latest multi-scanner run and dependency status after PR #70.	Updated report generation timestamp, branch reference, and PR/version context in the header copy. Adjusted executive summary KPIs and narrative to show that datasets was already remediated in PR fix: v3.1.2 — CVE remediation (datasets bump) + multi-scanner security reports #69 and that no new easy pyproject.toml bumps are available. Refined scanner status notes, including distinguishing Grype dir/SBOM scan behavior and noting osv-scanner’s "0 vulnerabilities can be fixed" outcome. Updated the Python/poetry.lock findings table to remove the datasets row, add pip-audit as a detector for diskcache, and reference OpenVEX version 7. Refreshed proxy-image CVE rows with expanded or clarified descriptions while preserving the same underlying IDs and severities.	security/reports/cve-report.html
Regenerated human-review HTML to align with the current vulnerability state and VEX decisions post-PR #70.	Updated timestamps and context text to reference post-PR fix: v3.1.2 — keep tied db_lookup candidates when score_cutoff floors (fix-46z) #70 state and that the datasets remediation from fix: v3.1.2 — CVE remediation (datasets bump) + multi-scanner security reports #69 is already on main. Clarified that the document now only covers findings that cannot be closed by an easy pyproject.toml bump, since the prior bump is already applied. Updated the diskcache rationale to reference OpenVEX version 7 while keeping the not_affected justification and mitigation guidance intact. Rewrote the pyproject.toml outcome section to state there are no new easy bumps in this refresh, that package version stays at v3.1.2, and that diskcache remains the only locked-graph advisory with no fixed version. Adjusted meta text to describe this as a post-PR fix: v3.1.2 — keep tied db_lookup candidates when score_cutoff floors (fix-46z) #70 refresh and to keep optional follow-up items (Snyk token, Docker Hub auth, first-party Dockerfile) explicitly out of scope.	security/reports/human-review.html
Updated the OpenVEX manifest to a new version while reaffirming the diskcache vulnerability as not_affected.	Bumped the OpenVEX document version from 6 to 7 to represent the new attestation set associated with this scan refresh. Revalidated and preserved the not_affected status and justification for the diskcache CVE, keeping it aligned with the human-review rationale and scanner suppression behavior.	security/vex/fastworkflow.openvex.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.