docs(security): refresh multi-scanner CVE reports after #73 / v3.2.0

[cursor]

Summary

Re-ran the multi-scanner CVE suite after the merge of #73 (v3.2.0) and refreshed the tracked security reports.

Scanner coverage

• Ran: Trivy, Grype, Syft, osv-scanner, Dockle, Dive (proxy image python:3.13-slim-bookworm)
• Skipped (auth): Snyk (SNYK_TOKEN unset), Docker Scout (Hub login required)

Easy pyproject.toml fixes

None available this run. osv-scanner reports “0 vulnerabilities can be fixed.” The only remaining Python advisory is transitive diskcache==5.6.3 (CVE-2025-69872 / GHSA-w8v5-vhqr-4h9v / PYSEC-2026-2447) with no patched PyPI release (latest still 5.6.3).

Prior remediation already on main (datasets ^5.0.1, security floors for litellm/multipart/starlette/cryptography/etc.) remains effective.

Changes in this PR

• Refresh security/reports/cve-report.html (consolidated scanner status + findings)
• Refresh security/reports/human-review.html (FIX/IGNORE recommendations with rationale — all current items IGNORE)
• Bump OpenVEX to version 7 (security/vex/fastworkflow.openvex.json) with post-feat: v3.2.0 — observability store, chatbot debug UI, and conversation-store consolidation #73 re-validation notes

Notes

Supersedes the stale open refresh in #72 (post-#70). No product version bump — report/VEX docs only.

  

Summary by Sourcery

Refresh the security reports and OpenVEX record following the v3.2.0 multi-scanner re-scan.

Enhancements:

• Refresh the consolidated CVE and human-review reports with post-v3.2.0 scanner results and current risk assessments.
• Update the tracked OpenVEX document to version 7 with re-validation notes for the remaining accepted findings.

Documentation:

• Document that no additional dependency fixes are currently available and retain IGNORE recommendations for the unpatched diskcache advisory and proxy-image findings.

[sourcery-ai]

Reviewer's Guide

This documentation-only PR re-runs and records the multi-scanner security assessment after v3.2.0, updates the CVE and human-review HTML reports, and advances OpenVEX to version 7; no application code, dependency constraints, or product version are changed.

Flow diagram for the v3.2.0 security report refresh

flowchart LR
    Release[v3.2.0 merge] --> Scan[Run multi-scanner CVE suite]
    Scan --> Findings[Consolidate findings]
    Findings --> Reports[Refresh CVE and human-review HTML reports]
    Findings --> VEX[Update OpenVEX to version 7]
    Reports --> Review[Human review: IGNORE current items]
    VEX --> Clean[Trivy and Grype: 0 open matches]
    Scan --> NoFix[osv-scanner: 0 vulnerabilities can be fixed]

Loading

File-Level Changes

Change	Details	Files
Refresh the consolidated multi-scanner CVE report for the post-v3.2.0 dependency and proxy-image scan.	Update scan timestamp, branch/release context, scanner versions, and authentication-skipped statuses. Replace the prior datasets remediation entry with the current diskcache-only Python finding and no available package fixes. Update proxy-image CVE totals and individual findings, including newly reported SQLite and Perl advisories. Document that OpenVEX suppresses the diskcache finding for the product while proxy-image findings remain out of product scope.	security/reports/cve-report.html
Refresh the human-review decisions and rationale for all outstanding findings.	Retain diskcache as an IGNORE/VEX decision because no patched release exists and exploitation requires cache-directory write access. Retain proxy-image OS and container-hardening findings as IGNORE because the repository ships a PyPI package and has no first-party Dockerfile. Record that no pyproject.toml fixes were applied in this scan and summarize prior remediations and skipped authenticated scanners.	security/reports/human-review.html
Advance the product OpenVEX document to version 7 with post-PR #73 validation metadata.	Update the VEX version and re-validation notes to align with the refreshed scanner evidence and diskcache disposition.	security/vex/fastworkflow.openvex.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.