docs(security): refresh CVE reports after PR #78

[cursor]

Summary

• Re-ran multi-scanner CVE suite (Trivy, Grype, Syft, osv-scanner, Dockle, Dive; Snyk/Scout skipped — no auth tokens) against the post-PR fix(train): do not refuse publication for below-floor labels #78 / v3.2.1 tree.
• No easy third-party bumps available in pyproject.toml: OSV/osv-scanner report 0 fixable Python vulns; sole locked finding remains diskcache==5.6.3 (CVE-2025-69872) with no PyPI fix.
• Refreshed tracked HTML reports and bumped OpenVEX to v8 (diskcache not_affected re-validated).

Reports

• security/reports/cve-report.html — consolidated scanner status + findings
• security/reports/human-review.html — FIX/IGNORE recommendations with rationale (all IGNORE this run)
• security/vex/fastworkflow.openvex.json — version 8

Test plan

• Syft SBOM from poetry.lock (141 artifacts)
• Trivy/Grype clean with OpenVEX v8; diskcache MEDIUM pre-VEX
• osv-scanner + pip-audit + OSV querybatch: diskcache only, no fixed version
• Dockle/Dive/Trivy-image on proxy python:3.13-slim-bookworm (non-product)

  

Summary by Sourcery

Refresh security scan documentation and OpenVEX data for the post-PR #78 dependency tree without changing dependencies.

Enhancements:

• Refresh the tracked multi-scanner vulnerability reports for the v3.2.1 tree, documenting the current dependency and proxy-image findings and scanner status.
• Update the human review to confirm the remaining diskcache advisory is not fixable through dependency updates and remains out of scope for the product proxy image.

Documentation:

• Refresh the consolidated CVE and human-review HTML reports with the latest scan results and remediation rationale.

Chores:

• Bump the tracked OpenVEX document to version 8 and revalidate diskcache as not affected.

[sourcery-ai]

Reviewer's Guide

Refreshes the tracked security reports and OpenVEX assessment for the post-PR #78/v3.2.1 tree, confirming diskcache as the only locked Python advisory with no available fix, no dependency changes this run, and all reviewed findings ignored or out of product scope.

Flow diagram for the refreshed vulnerability assessment

flowchart LR
    Tree["v3.2.1 post-PR-78 tree"] --> SBOM["Syft SBOM\n141 artifacts"]
    SBOM --> Scanners["Trivy, Grype, osv-scanner, pip-audit"]
    Scanners --> Finding["diskcache 5.6.3\nCVE-2025-69872\nno fixed PyPI release"]
    Finding --> VEX["OpenVEX v8\nnot_affected"]
    VEX --> Clean["0 open Python vulnerabilities"]

Loading

File-Level Changes

Change	Details	Files
Refresh the consolidated scanner report for the post-PR #78/v3.2.1 dependency tree.	Update scan timestamp, source revision, tool versions, and artifact counts. Replace the former datasets remediation with the current diskcache-only finding and no-fixable-bumps outcome. Refresh Python findings, scanner statuses, proxy-image CVE inventory, and generated-artifact references. Record Snyk and Docker Scout as skipped because credentials are unavailable.	security/reports/cve-report.html
Update the human-review decisions and rationale for the current vulnerability set.	Revalidate diskcache as IGNORE/not affected under the updated threat-model rationale and OpenVEX version. Update proxy-image findings and clarify that they are outside the product scope. Document that this run applied no dependency changes and retains the v3.2.1 package version.	security/reports/human-review.html
Revise the tracked OpenVEX document for the refreshed vulnerability assessment.	Bump the OpenVEX document to version 8. Retain the diskcache not_affected statement with refreshed assessment metadata.	security/vex/fastworkflow.openvex.json

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.