# Advisories govulncheck reports against the Nix-built pad binary that are
# KNOWN and ACCEPTED. nix/vulnscan.sh (run by .github/workflows/nix.yml)
# fails only on advisories NOT listed here, so a new exposure in the Nix
# artifact breaks CI while the known backlog below stays visible instead of
# blocking every PR. See BUG-2567.
#
# Lines starting with '#' and blank lines are ignored. One GO-XXXX-NNNN per
# line; anything after whitespace on the line is treated as a comment.
#
# ── Go stdlib, earlier backlog: cleared ───────────────────────────────────
# The 8 stdlib advisories accepted here while nixos-26.05 shipped go 1.26.5
# (GO-2026-5026, -5942, -5972, -6088, -6089, -6090, -6091, -6218; BUG-2567)
# were removed when the nixpkgs input was updated to a revision shipping
# go 1.26.7 (BUG-2085). vulnscan.sh fails on any of them reappearing.
#
# ── Go stdlib: 12, until nixpkgs ships go 1.26.9 (2026-10-08) ───────────
# Published 2026-10-08, fixed in go1.26.9. The release binaries and images
# build with go1.26.9 (go.mod toolchain line), so they are clean; only this
# Nix artifact lags, because nixos-26.05 still ships go 1.26.8. The bump is
# NixOS/nixpkgs#571801 (merged to master) and its staging-26.05 backport
# #571809 (open). Remove this whole block when the nixpkgs input is updated
# to a revision with go 1.26.9; vulnscan.sh then fails if any reappears.
# rc.9 reachability for each is in PR #1922's description.
GO-2026-6599  html/template context reset (go1.26.9)
GO-2026-6600  html/template yield preceder (go1.26.9)
GO-2026-6603  net/http HTTP/2 Trailer memory (go1.26.9)
GO-2026-6605  net/http client CONNECT desync (go1.26.9)
GO-2026-6607  crypto/tls ECH extension refs (go1.26.9)
GO-2026-6608  mime/multipart header limit bypass (go1.26.9)
GO-2026-6609  net/http Range header limit (go1.26.9)
GO-2026-6610  net/http HTTP/2 transport framing (go1.26.9)
GO-2026-6611  net/http HTTP/2 window changes (go1.26.9)
GO-2026-6612  net/http HTTP/2 flow-control refund (go1.26.9)
GO-2026-6613  net/http server CONNECT desync (go1.26.9)
GO-2026-6617  net/http HTTP/2 HPACK race (go1.26.9)
#
# ── Precision artifacts of the stripped binary (1) ───────────────────────
# nix/package.nix builds with ldflags "-s -w", which strips the symbols
# govulncheck needs to prune its call graph, so on this artifact it
# treats every vulnerable symbol of an imported package as potentially
# called and reports these as affected. A symbol-precise scan of the
# same source (unstripped build, 2026-08-15) shows them UNCALLED —
# import-only, not reachable. They do NOT clear with the Go backport;
# each clears when its dependency is bumped past the advisory or
# dropped. (Cleared so far: GO-2026-6222 via x/image v0.45.0 and
# GO-2026-4985 via the otel exporter bump to v1.45.0, both 2026-08-15.)
# GO-2026-5932 will never clear. It is a deprecation advisory on the
# x/crypto/openpgp PACKAGE ("unmaintained, unsafe by design"), so no fixed
# version will ever exist, and the x/crypto MODULE cannot leave the graph:
# pad imports x/crypto/bcrypt itself. pad does not import openpgp; the
# symbol-precise local scan (`make vuln`) reports it only at module level,
# with 0 package results (BUG-2085). Accepted permanently.
GO-2026-5932  x/crypto/openpgp: unmaintained (uncalled)
