security(scan): Go 1.26.5 (crypto/tls CVE), x/sys bump, Slowloris timeouts#122
Merged
Conversation
…eouts Post-P0 adversarial re-scan (govulncheck + gosec) findings, all fixed: - Go 1.26.4 → 1.26.5: clears GO-2026-5856 (Encrypted Client Hello privacy leak in crypto/tls) — reachable from the web dashboard server, ghost client, and improve scrapers. govulncheck now reports 0 vulnerabilities affecting our code. - golang.org/x/sys v0.36.0 → v0.44.0: clears GO-2026-5024 (integer overflow in NewNTUnicodeString, windows-only, not called by our code — hygiene bump). - ReadHeaderTimeout: 10s on both the web dashboard and memory dashboard http.Servers (gosec G112 Slowloris). - Annotated three gosec false positives with rationale: G101 on FIGMA_TOKEN env-var NAME and the public figma.com settings URL; G703 on copyDesignDir (os.ReadDir base names cannot contain separators). Remaining gosec MEDIUM/LOW volume (G204 subprocess, G304 file inclusion, G301/G306 perms, G104 best-effort discards) is the documented accepted baseline for a subprocess-orchestration tool — golangci-lint remains at 0 issues. go vet clean; full go test ./... -count=1 green on go1.26.5. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Post-P0 re-scan (govulncheck + gosec) of the merged mainline:
gosec HIGH: 0 remaining. Full
go test ./... -count=1+go vetgreen on go1.26.5.🤖 Generated with Claude Code