compose-cli/security/openvex.json at main · PastureStack/compose-cli · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
{
  "@context": "https://openvex.dev/ns/v0.2.0",
  "@id": "https://github.com/PastureStack/compose-cli/security/openvex/2026-08-25",
  "author": "PastureStack contributors",
  "timestamp": "2026-09-07T22:15:00+08:00",
  "version": 2,
  "statements": [
    {
      "vulnerability": {
        "name": "GO-2026-5932"
      },
      "products": [
        {
          "@id": "pkg:golang/golang.org/x/crypto@v0.56.0"
        }
      ],
      "status": "not_affected",
      "justification": "vulnerable_code_not_present",
      "impact_statement": "GO-2026-5932 is limited to the discontinued golang.org/x/crypto/openpgp package. This repository uses maintained bcrypt and scrypt packages through Sprig. The complete package graph and vendored sources contain no openpgp package, enforced by the source gate. The v0.56.0 dependency update also resolves the module-level SSH advisories CVE-2026-56855 and CVE-2026-78662 without adding SSH or OpenPGP imports."
    }
  ]
}