# Advisories govulncheck reports against the Nix-built pad binary that are
# KNOWN and ACCEPTED. nix/vulnscan.sh (run by .github/workflows/nix.yml)
# fails only on advisories NOT listed here, so a new exposure in the Nix
# artifact breaks CI while the known backlog below stays visible instead of
# blocking every PR. See BUG-2567.
#
# Lines starting with '#' and blank lines are ignored. One GO-XXXX-NNNN per
# line; anything after whitespace on the line is treated as a comment.
#
# ── Go stdlib: none ──────────────────────────────────────────────────────
# The 8 stdlib advisories accepted here while nixos-26.05 shipped go 1.26.5
# (GO-2026-5026, -5942, -5972, -6088, -6089, -6090, -6091, -6218; BUG-2567)
# were removed when the nixpkgs input was updated to a revision shipping
# go 1.26.7 (BUG-2085). vulnscan.sh fails on any of them reappearing.
#
# ── Precision artifacts of the stripped binary (1) ───────────────────────
# nix/package.nix builds with ldflags "-s -w", which strips the symbols
# govulncheck needs to prune its call graph, so on this artifact it
# treats every vulnerable symbol of an imported package as potentially
# called and reports these as affected. A symbol-precise scan of the
# same source (unstripped build, 2026-08-15) shows them UNCALLED —
# import-only, not reachable. They do NOT clear with the Go backport;
# each clears when its dependency is bumped past the advisory or
# dropped. (Cleared so far: GO-2026-6222 via x/image v0.45.0 and
# GO-2026-4985 via the otel exporter bump to v1.45.0, both 2026-08-15.)
# GO-2026-5932 will never clear. It is a deprecation advisory on the
# x/crypto/openpgp PACKAGE ("unmaintained, unsafe by design"), so no fixed
# version will ever exist, and the x/crypto MODULE cannot leave the graph:
# pad imports x/crypto/bcrypt itself. pad does not import openpgp; the
# symbol-precise local scan (`make vuln`) reports it only at module level,
# with 0 package results (BUG-2085). Accepted permanently.
GO-2026-5932  x/crypto/openpgp: unmaintained (uncalled)
