26881398633
66%

Ran 03 Jun 2026 11:27AM UTC

Jobs 1

Files 747

Run time 2min

Badge

Embed ▾

Committed 03 Jun 2026 11:20AM UTC coverage: 65.86% (+0.005%) from 65.855%

Build # 26881398633

Build Type

push

github

Committed by

web-flow

Commit Message

Ignore go1.26.4 stdlib vulns in govulncheck until toolchain bump (#5425)

The daily Security Scan and every open PR started failing on 2026-06-03
after three Go standard-library advisories were published on 2026-06-02:

  GO-2026-5037 (CVE-2026-27145, crypto/x509 VerifyHostname)
  GO-2026-5038 (CVE-2026-42504, mime WordDecoder.DecodeHeader)
  GO-2026-5039 (CVE-2026-42507, net/textproto error messages)

All three are stdlib DoS / log-injection issues (no RCE) fixed in
go1.26.4 / go1.25.11. CI builds with `setup-go: stable`, which still
resolves to go1.26.3 because the actions/go-versions manifest lags the
release, so govulncheck flags them on code we do not control.

Add the three OSV IDs to the documented IGNORED_VULNS exclusion list to
unblock CI. This is temporary and should be removed once CI builds on
go1.26.4 or later.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Coverage Stats

66405 of 100827 relevant lines covered (65.86%)

63.94 hits per line

Coverage Regressions

Lines	Coverage	∆	File
2	73.63	-0.64%	pkg/runner/config.go
2	78.17	-0.51%	pkg/transport/proxy/httpsse/http_proxy.go
2	57.89	-3.51%	pkg/transport/session/sse_session.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	26881398633.1	03 Jun 2026 11:27AM UTC	747	65.86	GitHub Action Run

stacklok / toolhive / 26881398633
66%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 26881398633

stacklok / toolhive / 26881398633 66%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 26881398633

stacklok / toolhive / 26881398633
66%

README BADGES
x