42208824384
72%

Ran 06 Nov 2026 11:20AM UTC

Jobs 1

Files 208

Run time 1min

Badge

Embed ▾

Committed 06 Nov 2026 11:14AM UTC coverage: 71.732% (+0.04%) from 71.694%

Build # 42208824384

Build Type

push

github

Committed by

web-flow

Commit Message

fix(vulncheck): ignore GO-2026-6909 (crewjam/saml, no fix available) (#2909)

## What

Adds `GO-2026-6909` to the `vulncheck-filter` ignore map so `make
vulncheck` passes again. It currently fails on every branch (e.g.
#2893).

## Why it's safe to ignore

[GO-2026-6909](https://pkg.go.dev/vuln/GO-2026-6909) affects
`github.com/crewjam/saml` through v0.5.1, and **there's no upstream
fix**. We're on v0.4.14, reached via `handleSamlAcs →
ServiceProvider.ParseResponse`.

The advisory covers two issues, and both need an assertion signed by an
IdP we already trust:

1. **Nil `assertion.Issuer` dereference** in `validateAssertion`. It
panics only after signature verification. The `recoverer` middleware
(`internal/api/api.go`) catches the panic, so the result is a 500 for
that one request, not a process crash.
2. **Namespace-blind `Subject.NameID`**. We read `NameID` in
`SAMLAssertion.SubjectID()` only when the `subject-id` attribute is
missing. Exploiting it would need the IdP itself to sign an assertion
that leaves out `<saml:NameID>` and includes a foreign-namespace
`<NameID>`. An attacker can't inject that element without breaking the
signature.

Remove this entry once crewjam/saml ships a fix.

## Verification

- `go test ./hack/vulncheck-filter` passes
- `govulncheck ./... | go run ./hack/vulncheck-filter` exits 0

Coverage Stats

16791 of 23408 relevant lines covered (71.73%)

515.39 hits per line

Coverage Regressions

Lines	Coverage	∆	File
121	76.58	0.31%	internal/models/user.go
68	65.2	1.63%	internal/api/token.go

Jobs

ID	Job ID	Ran	Files	Coverage
1	42208824384.1	06 Nov 2026 11:20AM UTC	208	71.73	GitHub Action Run

supabase / auth / 42208824384
72%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 42208824384

supabase / auth / 42208824384 72%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Coverage Regressions

Jobs

Source Files on build 42208824384

supabase / auth / 42208824384
72%

README BADGES
x