From 80ece9c4fc497a57c0fdb45f0a33c4fb68730e81 Mon Sep 17 00:00:00 2001 From: Josh Knapp Date: Mon, 12 Oct 2026 10:49:41 -0700 Subject: [PATCH] Bump moby/sys/user to v0.4.1; document accepted test-only docker/docker findings Co-Authored-By: Claude Sonnet 5.5 --- go.mod | 2 +- go.sum | 4 ++-- osv-scanner.toml | 19 +++++++++++++++++++ 3 files changed, 22 insertions(+), 3 deletions(-) create mode 100644 osv-scanner.toml diff --git a/go.mod b/go.mod index df19e8481..e7f843835 100644 --- a/go.mod +++ b/go.mod @@ -176,7 +176,7 @@ require ( github.com/mitchellh/go-homedir v1.1.0 // indirect github.com/mitchellh/reflectwalk v1.0.2 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect - github.com/moby/sys/user v0.4.0 // indirect + github.com/moby/sys/user v0.4.1 // indirect github.com/moby/term v0.5.2 // indirect github.com/mtibben/percent v0.2.1 // indirect github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect diff --git a/go.sum b/go.sum index 84ad8c615..342d2882e 100644 --- a/go.sum +++ b/go.sum @@ -398,8 +398,8 @@ github.com/moby/moby/api v1.53.0 h1:PihqG1ncw4W+8mZs69jlwGXdaYBeb5brF6BL7mPIS/w= github.com/moby/moby/api v1.53.0/go.mod h1:8mb+ReTlisw4pS6BRzCMts5M49W5M7bKt1cJy/YbAqc= github.com/moby/moby/client v0.2.2 h1:Pt4hRMCAIlyjL3cr8M5TrXCwKzguebPAc2do2ur7dEM= github.com/moby/moby/client v0.2.2/go.mod h1:2EkIPVNCqR05CMIzL1mfA07t0HvVUUOl85pasRz/GmQ= -github.com/moby/sys/user v0.4.0 h1:jhcMKit7SA80hivmFJcbB1vqmw//wU61Zdui2eQXuMs= -github.com/moby/sys/user v0.4.0/go.mod h1:bG+tYYYJgaMtRKgEmuueC0hJEAZWwtIbZTB+85uoHjs= +github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0= +github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y= github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc= github.com/morikuni/aec v1.0.0 h1:nP9CBfwrvYnBRgY6qfDQkygYDmYwOilePFkwzv4dU8A= diff --git a/osv-scanner.toml b/osv-scanner.toml new file mode 100644 index 000000000..5bbaecfb6 --- /dev/null +++ b/osv-scanner.toml @@ -0,0 +1,19 @@ +# Known, accepted findings. Revisit before ignoreUntil or when upstream publishes a fix. + +# github.com/docker/docker 28.5.2: no fixed version published yet. Test-only +# transitive dependency (golang-migrate -> dktest, used by DB tests); no +# non-test package imports it and govulncheck reports it as not reachable. +[[IgnoredVulns]] +id = "GO-2026-4883" +ignoreUntil = 2026-12-31 +reason = "docker/docker has no fix; test-only transitive dep, not reachable" + +[[IgnoredVulns]] +id = "GHSA-pxq6-2prw-chj9" +ignoreUntil = 2026-12-31 +reason = "alias of GO-2026-4883; test-only, not reachable" + +[[IgnoredVulns]] +id = "GO-2026-4887" +ignoreUntil = 2026-12-31 +reason = "docker/docker has no fix; test-only transitive dep, not reachable"