From 3d90fa4023d164b0dea6f6e51809de8cee28433f Mon Sep 17 00:00:00 2001
From: Amit Kotagi <53637075+amitsk6@users.noreply.github.com>
Date: Thu, 9 Jul 2026 15:50:16 +0530
Subject: [PATCH] chore: supress opengp vulnerability (#823)

---
 .release/security-scan.hcl | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.release/security-scan.hcl b/.release/security-scan.hcl
index c6d28da2..b203cfd9 100644
--- a/.release/security-scan.hcl
+++ b/.release/security-scan.hcl
@@ -11,4 +11,18 @@ binary {
   osv          = true
   oss_index    = false
   nvd          = false
+
+    triage {
+    suppress {
+      vulnerabilities = [
+        // golang.org/x/crypto/openpgp is deprecated/unmaintained with no fixed
+        // version. The provider does not use this package (confirmed via
+        // `go mod why golang.org/x/crypto/openpgp`); it imports the maintained
+        // fork github.com/ProtonMail/go-crypto/openpgp instead. x/crypto is
+        // only pulled in for the unaffected golang.org/x/crypto/cryptobyte
+        // package. Not reachable in the built binary.
+        "GO-2026-5932",
+      ]
+    }
+  }
 }