security: post-#75 CVE scan refresh (OpenVEX v7 + HTML reports)

[cursor]

Summary

Post-merge CVE automation after PR #75.

• Re-ran Trivy, Grype, Syft, osv-scanner, Dockle, and Dive.
• Snyk and Docker Scout were skipped (no SNYK_TOKEN / Docker Hub login in this environment).
• No easy pyproject.toml bumps: OSV reports "0 vulnerabilities can be fixed"; the only Python finding remains diskcache==5.6.3 (CVE-2025-69872 / PYSEC-2026-2447) with no PyPI patched release.
• Refreshed tracked HTML reports and bumped OpenVEX to v7 (re-validation after Fix training behavior for thin labels and missing provenance #75).

Reports

• security/reports/cve-report.html — consolidated scanner status
• security/reports/human-review.html — FIX/IGNORE recommendations with rationale
• security/vex/fastworkflow.openvex.json — OpenVEX v7

Human-review highlights

• IGNORE diskcache pickle RCE (accepted via OpenVEX; not remotely reachable)
• IGNORE proxy-image OS CVEs (python:3.13-slim-bookworm; no first-party Dockerfile)
• IGNORE Dockle CIS findings on proxy image
• FIX (optional/docs): document DSPy disk-cache directory hardening for operators

Test plan

• Syft SBOM from poetry.lock (141 packages)
• Trivy/Grype with OpenVEX → 0 open poetry findings
• osv-scanner + pip-audit confirm only diskcache / no fix
• Dockle/Dive/Trivy-image on proxy python:3.13-slim-bookworm

  

Summary by Sourcery

Refresh post-merge security scanning and vulnerability records, updating OpenVEX and reports while confirming that no dependency upgrade is currently available for the remaining diskcache advisory.

Enhancements:

• Refresh the consolidated vulnerability and human-review reports with post-PR Fix training behavior for thin labels and missing provenance #75 scanner results and updated findings.
• Revalidate the dependency vulnerability assessment across the 141-package lockfile, confirming no actionable version upgrades and documenting the remaining diskcache advisory.
• Expand human-review guidance with DSPy disk-cache hardening recommendations and updated proxy-image scope decisions.

Documentation:

• Document operator guidance to keep DSPy disk-cache directories private, non-shared, and restricted to the service user.

Tests:

• Re-run SBOM generation and Trivy, Grype, osv-scanner, pip-audit, Dockle, and Dive security checks, with Snyk and Docker Scout skipped due to unavailable credentials.

Chores:

• Update the OpenVEX statement to version 7 and refresh its accepted-risk coverage.

[sourcery-ai]

Reviewer's Guide

This PR refreshes the tracked security artifacts after PR #75: scanner results and proxy-image data are regenerated, the sole remaining diskcache advisory is revalidated with no dependency fix available, human-review decisions and cache-hardening guidance are updated, and the OpenVEX document is bumped to v7 to suppress the accepted finding in Trivy and Grype.

Sequence diagram for diskcache vulnerability validation

sequenceDiagram
    participant S as Security scanners
    participant L as poetry.lock
    participant V as OpenVEX v7
    participant R as Security reports

    S->>L: Scan 141 locked packages
    L-->>S: diskcache 5.6.3 advisory
    S->>S: Query fixed versions
    S-->>R: Report no available fix
    R->>V: Revalidate diskcache finding
    V-->>S: not_affected
    S-->>R: Trivy and Grype report 0 open poetry findings

Loading

Flow diagram for the CVE scan refresh and OpenVEX review

flowchart LR
    A[poetry.lock and proxy image] --> B[Security scanners]
    B --> C[Consolidated HTML reports]
    C --> D[Human review]
    D --> E[OpenVEX v7]
    E --> F[Trivy and Grype report zero open poetry findings]
    D --> G[Optional DSPy cache hardening guidance]

Loading

File-Level Changes

Change	Details	Files
Refresh the consolidated scanner report with post-PR #75 results and updated proxy-image findings.	Update scan timestamp, branch/commit, and package metadata. Record 141-package SBOM and scanner outcomes, including skipped Snyk and Docker Scout runs. Reconcile diskcache as the sole unfixed Python advisory and show zero open lockfile findings after VEX. Refresh proxy-image CVE inventory, digest, severity totals, and Dive gate status.	security/reports/cve-report.html
Update the human-review decisions and operational follow-ups for the refreshed findings.	Revalidate the diskcache no-patched-release rationale and retain an IGNORE/VEX decision. Classify proxy-image CVEs and Dockle findings as out of product scope until a first-party image exists. Add a low-cost FIX recommendation to document DSPy cache directory ownership, permissions, and trust-boundary requirements. Document that no dependency bumps were applied and retain prior dependency floors.	security/reports/human-review.html
Revalidate and bump the project OpenVEX document to version 7.	Update the VEX metadata and diskcache statement to align with the refreshed scan. Preserve the not_affected justification for the non-remotely reachable pickle deserialization finding.	security/vex/fastworkflow.openvex.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.