[daniel-garcia]

govulncheck -mode binary against the built CLI found two reachable findings. Both are fixed here; the shipped artifact now reports zero reachable vulnerabilities.

Findings

advisory	module	before	after
GO-2026-5841 — OOB read in compress/s2	klauspost/compress	v1.18.0, reachable	v1.18.7, cleared
GO-2026-5932 — openpgp unmaintained / unsafe by design, no fix available	x/crypto via go-github/v39	reachable	not linked

go-github dropped its x/crypto dependency at v60; this goes to v92 (current). x/crypto is still in the module graph via other dependencies, but the openpgp package is no longer imported or linked — it drops from a reachable finding to a module-graph-only advisory.

API changes this required

go-github v92 changed the client constructor, so this isn't a pure version bump:

• NewClient now takes options and returns an error. WithHTTPClient explicitly rejects a nil client, and source/github could previously pass nil (the URL may carry no user info, where v39 silently fell back to http.DefaultClient). The option is now applied only when a client exists, preserving that behaviour rather than turning it into an error.
• NewEnterpriseClient was removed. source/github_ee composes WithHTTPClient + WithEnterpriseURLs instead.

Verification

Built at the real shipped build tags with Go 1.26.8, then scanned:

=== Symbol Results ===
No vulnerabilities found.
Your code is affected by 0 vulnerabilities.

• go build ./..., go vet ./... clean.
• go test ./source/... ./internal/... . passes, including source/github and source/github_ee.
• Embedded build info on the scanned binary confirms go-github v92.0.0, compress v1.18.7, go1.26.8.

Two scanning notes worth recording, since both produced misleading results during this work:

1. A plain govulncheck ./... under-reports for this repo. Every driver sits behind a build tag, so a source scan without the Makefile tag set cannot see them — that's why the compress/s2 finding first appeared only at module level. Use binary mode, or source mode with the full tag set.
2. Docker layer caching produced a stale scan. A rebuild-and-rescan through docker build still reported openpgp as reachable after the fix, contradicting go mod why and go list -deps. Building directly with the toolchain resolved it. Don't trust a containerised rescan without --no-cache.

Note

Upstream is still on go-github v39, so future upstream merges will conflict on source/github/github.go and source/github_ee/github_ee.go.

Not addressed here: the docker/docker advisories (no fix available, and reachable only through dktesting, which is imported exclusively by _test.go files — never linked into the CLI or library).

🤖 Generated with Claude Code

[coveralls]

Coverage Report for CI Build 35295279278

Coverage increased (+0.03%) to 52.649%

Details

• Coverage increased (+0.03%) from the base build.
• Patch coverage: 4 uncovered changes across 1 file (11 of 15 lines covered, 73.33%).
• No coverage regressions found.

Uncovered Changes

File	Changed	Covered	%
source/github/github.go	9	5	55.56%
Total (2 files)	15	11	73.33%

Coverage Regressions

No coverage regressions found.

---

Coverage Stats

Relevant Lines:	8437
Covered Lines:	4442
Line Coverage:	52.65%
Coverage Strength:	6424.41 hits per line

---

💛 - Coveralls