From 7a7db7ff1490e02eebeb3bf540b32f45a239d692 Mon Sep 17 00:00:00 2001 From: rodrigodh Date: Tue, 14 Jul 2026 13:47:09 -0300 Subject: [PATCH] chore(ci): accept GO-2026-5932 (unmaintained x/crypto/openpgp) Fiber v3 pulls golang.org/x/crypto transitively via acme/autocert. The Go advisory GO-2026-5932 (openpgp unmaintained) has no fixed version and the openpgp package is not imported by this module, so it is suppressed via .trivyignore to unblock the Fiber v3 migration PRs across the wave. X-Lerian-Ref: 0x1 --- .trivyignore | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 0000000..753eae6 --- /dev/null +++ b/.trivyignore @@ -0,0 +1,9 @@ +# Trivy ignore file — accepted-risk advisories (reviewed by security). +# +# GO-2026-5932 — golang.org/x/crypto/openpgp is unmaintained. +# - No fixed version exists (advisory applies to all versions; "unmaintained"). +# - Pulled transitively via gofiber/fiber/v3 -> golang.org/x/crypto/acme/autocert. +# - The openpgp package is NOT imported by this module (only acme/autocert is +# reachable), so the unmaintained-package risk is not exercised here. +# - Accepted until an upstream (fiber/x-crypto) change removes the transitive edge. +GO-2026-5932