villebro opened a new pull request, #290: URL: https://github.com/apache/superset-kubernetes-operator/pull/290
## Summary The OpenSSF Scorecard **Vulnerabilities** check flags four advisories against **indirect** Go dependencies that were pinned below their fixed versions. This bumps each module to its fixed version to clear the finding. All four are transitive modules, so Go's minimal-version-selection kept them at whatever their parents require and Renovate's normal cadence did not raise them. | OSV / CVE | Indirect module | Was | Now | |---|---|---|---| | GO-2026-6094 (GHSA-gcjh-h69q-9w9g) | `github.com/google/cel-go` | 0.29.0 | 0.30.0 | | GO-2026-5158 (CVE-2026-41178) | `go.opentelemetry.io/otel` | 1.43.0 | 1.44.0 | | GO-2026-6179 (CVE-2026-56865) | `golang.org/x/mod` | 0.37.0 | 0.40.0 | | GO-2026-6180 (CVE-2026-56864) | `golang.org/x/mod` | 0.37.0 | 0.40.0 | ## Details Our `govulncheck` gate stays green because the built binary never reaches the vulnerable symbols (`cel-go/ext`, otel `baggage`/`propagation`, `x/mod/sumdb`). Scorecard uses version-based OSV scanning with no reachability analysis, so it flags these regardless of whether the code path is reachable — hence the discrepancy between our CI and the Scorecard result. The `go.opentelemetry.io/otel` `v1.x` family (`metric`, `trace`, `sdk`) is bumped together to avoid version skew. `go mod tidy` also carried a few adjacent `golang.org/x/*` updates along. Only `go.mod`/`go.sum` change; there are no source changes. Verified locally: `make build`, `make test-unit`, and `make codegen` (no drift) all pass. `govulncheck` runs in CI. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
