stacklok / toolhive / 33749926101
70%

DEFAULT BRANCH: main
Ran
Jobs 1
Files 905
Run time 2min
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 69.849% (+0.01%) from 69.838%
33749926101

push

github

web-flow 
Exclude the x/crypto/ssh DoS advisories from govulncheck (#6502)

* Upgrade golang.org/x/crypto to v0.56.0

GO-2026-6354 (CVE-2026-78662) and GO-2026-6355 (CVE-2026-56855) let a
malicious SSH peer deadlock a whole connection by flooding an undecided
channel's incomingRequests or by sending crafted messages on an
established one. Both are fixed in v0.56.0, and both fail the Security
Scan workflow's govulncheck gate on main since the advisories published.

The go directive moves to 1.26.0 because x/crypto v0.56.0 declares that
version; go mod tidy normalizes the main module to match, and go
generate fails without it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

* Exclude the x/crypto/ssh DoS advisories from govulncheck

GO-2026-6354 (CVE-2026-78662) and GO-2026-6355 (CVE-2026-56855) let a
malicious SSH peer deadlock a connection, and have failed the Security
Scan gate on main since they published on 2026-09-02.

The fix in x/crypto v0.56.0 cannot be taken. That release declares
`go 1.26.0`, Go orders the bare language version `1.26` below the
release `1.26.0`, and the lint workflow forbids a patch version in the
go directive, so the toolchain refuses to build either way.

Neither advisory is reachable. ToolHive never opens an SSH connection:
x/crypto/ssh is linked only because go-git registers every transport at
package init, and every caller of pkg/git.Clone goes through
gitresolver, which hardcodes the clone scheme to https.

Moving the go directive to 1.27 will satisfy x/crypto v0.56.0 without a
patch version, at which point both entries come back out.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

77250 of 110595 relevant lines covered (69.85%)

90.66 hits per line

Coverage Regressions

Lines Coverage ∆ File
2
87.5
 -6.25% pkg/vmcp/backendregistry/registry.go
1
94.96
 0.0% pkg/authserver/storage/memory.go
1
96.77
 -3.23% pkg/foreach/foreach.go
Jobs
ID Job ID Ran Files Coverage
1 33749926101.1 905
69.85
 GitHub Action Run
Source Files on build 33749926101