From 7221b322462179b2026a1f77d0a7c25e80a0940c Mon Sep 17 00:00:00 2001 From: kanywst Date: Tue, 14 Jul 2026 23:26:09 +0900 Subject: [PATCH 1/2] chore: bump Go to 1.26.5 to fix GO-2026-5856 in crypto/tls govulncheck flags GO-2026-5856 (Encrypted Client Hello privacy leak in crypto/tls) as reachable from evaluatePolicy and main. The vuln is fixed in go1.26.5, and CI resolves its toolchain from go-version-file: go.mod, so bumping the go directive is enough to clear the vuln job. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index 342f3f8..0bc0ef0 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/0-draft/mcp-opa -go 1.26.4 +go 1.26.5 require ( github.com/mark3labs/mcp-go v0.55.1 From 787921a8594dfb9676203958c14062049118b361 Mon Sep 17 00:00:00 2001 From: kanywst Date: Tue, 14 Jul 2026 23:30:36 +0900 Subject: [PATCH 2/2] ci: let osv-scanner resolve a Go toolchain so reachability analysis runs actions/setup-go exports GOTOOLCHAIN=local into the job env, and the osv-scanner action forwards it into its container. The container's bundled Go (1.26.2) is older than our go directive, so govulncheck-based code analysis fails to load packages and osv-scanner falls back to reporting every vulnerability in the module graph regardless of reachability. That surfaced GO-2026-5932 (golang.org/x/crypto/openpgp is unmaintained; no fixed version exists) even though we never import openpgp -- the only x/crypto package in our build is pbkdf2. Overriding GOTOOLCHAIN for this step lets the scanner fetch a matching toolchain and filter unreachable findings itself, rather than suppressing the advisory with an ignore list. --- .github/workflows/ci.yml | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index aeb8492..ba3049b 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -64,6 +64,12 @@ jobs: govulncheck ./... - name: osv-scanner (OSV.dev cross-ecosystem scan) uses: google/osv-scanner-action/osv-scanner-action@9a498708959aeaef5ef730655706c5a1df1edbc2 # v2.3.8 + env: + # setup-go exports GOTOOLCHAIN=local, which leaks into the scanner + # container. Its bundled Go is older than our go directive, so the + # reachability analysis can't load packages and every vuln in the + # module graph gets reported as if it were called. + GOTOOLCHAIN: auto with: scan-args: |- --recursive