Author	SHA1	Message	Date
Fimeg	7427174d99	deps: lift patched public floors ... CI found nine reachable Go issues and a high Axios advisory. Move to the published fixed floors and retire three stale Docker exceptions.	2026-08-20 13:14:28 -04:00
Fimeg	b3d946b84f	fix: add Docker daemon-side vulns to allowlist ... Add GO-2026-5617, GO-2026-5668, and GO-2026-5746 to .govulncheck-allow. These are all daemon-side Docker/Moby vulnerabilities that don't affect RedFlag because it uses the Docker client only for Ping, SecretList, and container scanning — never for docker cp, archive operations, or AuthZ paths. Also update SECURITY.md to document all accepted exceptions in a table.	2026-06-29 16:35:04 -04:00
Fimeg	e2dab2845a	supply-chain: gate our own deps, ship the verdict signed ... dep-scan.sh gates go/npm/cargo on push and bakes an attested posture into the release — embedded in the server, signed into the manifest. Reasoning and the two Moby exceptions are in SECURITY.md. (posture-builder runs rustup; bookworm's cargo is too old for cargo-audit.)	2026-06-14 11:43:23 -04:00