The GitHub Actions job "uv in /dev/breeze for cryptography - Update #1503619794" on airflow.git/main has failed. Run started by GitHub user dependabot[bot] (triggered by dependabot[bot]).
Head commit for run: 679cfca77abe9ac5a12592eb0fee559c4bdb92c0 / Jason(Zhe-You) Liu <[email protected]> Scan Go SDK dependencies for known vulnerabilities in CI (#70915) Go modules resolve directly to upstream repositories with no central registry that pre-scans releases the way PyPI and npm now do, so a known-vulnerable or compromised dependency can enter the graph without any external scanner flagging it first. Add a govulncheck step to the Go SDK test job on both the amd and arm CI workflows. govulncheck checks the module graph against the Go vulnerability database and is reachability based, so it only fails the build on advisories that affect code the SDK actually calls, keeping the signal low-noise. This complements the daily CodeQL scan (which covers our own Go source, not dependency advisories) and the advisory-driven Dependabot security updates. Report URL: https://github.com/apache/airflow/actions/runs/30858047437 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
