Fix x/net HTML vulnerabilities in bundle 0.16.6

.github/workflows/security-release-gate.yml

@@ -16,7 +16,7 @@ jobs:
     env:
       SOURCE_DATE_EPOCH: "0"
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:ee940acbf1f58ebadb42d01434ce4609530bf1b52536afbd1eee66cd7123c5c9
-      ARTIFACT_NAME: machine-driver-bundle-0.16.5-linux-amd64.tar.xz
+      ARTIFACT_NAME: machine-driver-bundle-0.16.6-linux-amd64.tar.xz
 
     steps:
       - name: Check out the reviewed source

README.md

@@ -3,10 +3,10 @@
 PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.
 
 This repository builds the Linux AMD64 machine-management bundle consumed by
-the PastureStack compatibility server. The current public GitHub Release is
-[`v0.16.5`](https://github.com/PastureStack/machine-driver-bundle/releases/tag/v0.16.5),
-and the generated archive and both rebuilt executables use numeric version
-`0.16.5` without a product or maintenance suffix.
+the PastureStack compatibility server. This source selects numeric version
+`0.16.6` for the bundle and both rebuilt executables. Checkout builds are review
+candidates; the matching [GitHub Release](https://github.com/PastureStack/machine-driver-bundle/releases/tag/v0.16.6)
+is the immutable distribution after its protected-main release gate completes.
 
 ## Reviewed inputs
 
@@ -41,14 +41,14 @@ make test
 Output:
 
 ```text
-dist/artifacts/machine-driver-bundle-0.16.5-linux-amd64.tar.xz
+dist/artifacts/machine-driver-bundle-0.16.6-linux-amd64.tar.xz
 ```
 
 Artifacts built directly from a checkout are review candidates. A GitHub Release, when present, is the reviewed distribution and its package is covered by GitHub Artifact Attestation generated from the protected default branch. Catalog changes, container-registry changes, and deployment remain intentionally excluded from this workflow.
 
 ## October 2026 security maintenance
 
-The source patches select `golang.org/x/net v0.60.0` and its required x/crypto, x/sys, x/term, and x/text updates. The patched module manifests and sums remain checksum-locked; CI rebuilds and checks the exact binaries before release.
+The source patches select official `golang.org/x/net v0.62.0` and its required x/crypto, x/sys, x/term, x/text and x/sync updates. This fixes [CVE-2026-78661](https://pkg.go.dev/vuln/GO-2026-6860) and [CVE-2026-97045](https://pkg.go.dev/vuln/GO-2026-6866) in the HTML parser/renderer without changing Docker Machine transport or provider APIs. The patched module manifests and sums remain checksum-locked; CI rebuilds and checks the exact binaries before release.
 
 Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Python tooling uses the patched pip/CA path; CI interpreter pins remain on the Python 3.14 series. Release artifacts must pass the repository's existing checks before publication.
 
@@ -59,5 +59,5 @@ finding with an official fix blocks release, regardless of severity. Unknown
 findings block unless a separately reviewed, exact not-affected statement is
 proved by the actual product dependency graph. LOW/MEDIUM findings without an
 official fix require the repository's exact CVE/package/version/PURL review ledger;
-new or changed findings fail closed. This policy-only update does not replace any
+new or changed findings fail closed. This new numeric release is qualified separately and does not replace any
 already published immutable artifact.

patches/README.md

@@ -1,10 +1,12 @@
 # Reviewed source patches
 
-Both patches are applied with zero fuzz to immutable, SHA-256-pinned upstream source archives.
+All patches are applied with zero fuzz to immutable, SHA-256-pinned upstream source archives.
 
 - `docker-machine-go-security.patch` replaces EOL cloud and Docker clients with their maintained APIs. Its reviewed runtime changes are limited to the CLI compatibility layer (including normalized string-slice RPC values), AWS EC2, Azure, Exoscale, vSphere, Docker client wiring, and the corresponding module locks and tests.
 - `packet-driver-go-security.patch` updates the retired provider's dependencies and replaces its machine library with the sibling, reviewed source tree used for the primary executable.
 
 The build verifies the resulting `go.mod` and `go.sum` files against fixed hashes before downloading modules. `scripts/validate` enforces an exact path boundary for the primary patch and keeps the retired provider patch limited to `go.mod` and `go.sum`.
 
-The external source tags retain their upstream spelling for provenance. The PastureStack bundle and both rebuilt executables expose only the numeric candidate version `0.16.4`.
+The external source tags retain their upstream spelling for provenance. The PastureStack bundle and both rebuilt executables expose only the numeric candidate version `0.16.6`.
+
+The `docker-machine-xnet062.patch` and `packet-driver-xnet062.patch` follow the existing security patches and only change `go.mod`/`go.sum`. They select official x/net 0.62.0 and the minimum Go module dependency closure for CVE-2026-78661 and CVE-2026-97045; provider and transport implementation code is unchanged.

patches/docker-machine-xnet062.patch

@@ -0,0 +1,84 @@
+diff --git a/go.mod b/go.mod
+--- a/go.mod
++++ b/go.mod
+@@ -30,11 +30,11 @@
+ 	github.com/urfave/cli v1.22.17
+ 	github.com/vmware/govcloudair v0.0.2
+ 	github.com/vmware/govmomi v0.56.0
+-	golang.org/x/crypto v0.57.0
+-	golang.org/x/net v0.60.0
++	golang.org/x/crypto v0.58.0
++	golang.org/x/net v0.62.0
+ 	golang.org/x/oauth2 v0.36.0
+-	golang.org/x/sys v0.48.0
+-	golang.org/x/term v0.46.0
++	golang.org/x/sys v0.49.0
++	golang.org/x/term v0.47.0
+ 	google.golang.org/api v0.293.0
+ )
+
+@@ -95,8 +95,8 @@
+ 	go.opentelemetry.io/otel/metric v1.45.0 // indirect
+ 	go.opentelemetry.io/otel/trace v1.45.0 // indirect
+ 	go.yaml.in/yaml/v3 v3.0.5 // indirect
+-	golang.org/x/sync v0.23.0 // indirect
+-	golang.org/x/text v0.42.0 // indirect
++	golang.org/x/sync v0.24.0 // indirect
++	golang.org/x/text v0.43.0 // indirect
+ 	golang.org/x/time v0.15.0 // indirect
+ 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260807164820-c8921c73eeea // indirect
+ 	google.golang.org/grpc v1.83.2 // indirect
+diff --git a/go.sum b/go.sum
+--- a/go.sum
++++ b/go.sum
+@@ -279,6 +279,8 @@
+ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
+ golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+ golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
++golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
++golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+ golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+ golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
+ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
+@@ -289,6 +291,8 @@
+ golang.org/x/net v0.0.0-20210913180222-943fd674d43e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
+ golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU=
+ golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg=
++golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
++golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
+ golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
+ golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
+ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+@@ -296,6 +300,8 @@
+ golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
+ golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk=
+ golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
++golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
++golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+@@ -312,10 +318,14 @@
+ golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+ golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+ golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
++golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
++golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+ golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw=
+ golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
+ golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+ golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
++golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
++golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
+ golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk=
+ golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
+@@ -323,6 +333,8 @@
+ golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
+ golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI=
+ golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E=
++golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
++golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+ golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+ golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
+ golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=

patches/packet-driver-xnet062.patch

@@ -0,0 +1,47 @@
+diff --git a/go.mod b/go.mod
+--- a/go.mod
++++ b/go.mod
+@@ -14,9 +14,10 @@
+ 	github.com/google/go-cmp v0.7.0 // indirect
+ 	go.yaml.in/yaml/v2 v2.4.4 // indirect
+ 	go.yaml.in/yaml/v3 v3.0.5 // indirect
+-	golang.org/x/crypto v0.57.0 // indirect
+-	golang.org/x/sys v0.48.0 // indirect
+-	golang.org/x/term v0.46.0 // indirect
++	golang.org/x/crypto v0.58.0 // indirect
++	golang.org/x/net v0.62.0 // indirect
++	golang.org/x/sys v0.49.0 // indirect
++	golang.org/x/term v0.47.0 // indirect
+ 	gopkg.in/yaml.v2 v2.4.0 // indirect
+ )
+
+diff --git a/go.sum b/go.sum
+--- a/go.sum
++++ b/go.sum
+@@ -27,14 +27,26 @@
+ golang.org/x/crypto v0.0.0-20200420201142-3c4aac89819a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+ golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M=
+ golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA=
++golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
++golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+ golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
++golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY=
++golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI=
++golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA=
++golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0=
+ golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
+ golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
+ golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo=
+ golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
++golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA=
++golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+ golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE=
+ golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc=
++golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
++golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=
+ golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
++golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc=
++golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s=
+ golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
+ gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+ gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=

provider-lifecycle.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "bundleVersion": "0.16.5",
+  "bundleVersion": "0.16.6",
   "machineTool": {
     "sourceTag": "v0.16.2-gitlab.52",
     "sourceCommit": "95d190cbe55757b4212b69d0a278151d1faaaf66",

scripts/build-binaries

@@ -60,6 +60,26 @@ export GOFLAGS="-mod=readonly -p=$go_parallelism"
 )
 
 chmod 0755 "$machine_binary" "$packet_binary"
+if [ "${GITHUB_ACTIONS:-}" = true ] && {
+  [ "$(sha256sum "$machine_binary" | awk '{print $1}')" != "$DOCKER_MACHINE_BINARY_SHA256" ] ||
+  [ "$(sha256sum "$packet_binary" | awk '{print $1}')" != "$PACKET_DRIVER_BINARY_SHA256" ];
+}; then
+  # Preserve qualification bytes; the checksum gates below still reject them.
+  qualification="$repo_root/evidence/hash-qualification"
+  mkdir -p "$qualification"
+  install -m 0755 "$machine_binary" "$qualification/docker-machine"
+  install -m 0755 "$packet_binary" "$qualification/docker-machine-driver-packet"
+  python3 "$repo_root/scripts/collect-licenses.py" \
+    --machine-source "$machine_source" --packet-source "$packet_source" \
+    --machine-binary "$machine_binary" --packet-binary "$packet_binary" \
+    > "$qualification/machine-driver-bundle-DEPENDENCY-LICENSES.txt"
+  cp "$machine_source/go.mod" "$qualification/docker-machine.go.mod"
+  cp "$machine_source/go.sum" "$qualification/docker-machine.go.sum"
+  cp "$packet_source/go.mod" "$qualification/packet-driver.go.mod"
+  cp "$packet_source/go.sum" "$qualification/packet-driver.go.sum"
+  (cd "$qualification" && sha256sum docker-machine docker-machine-driver-packet \
+    machine-driver-bundle-DEPENDENCY-LICENSES.txt > SHA256SUMS)
+fi
 sha256sum "$machine_binary" "$packet_binary"
 printf '%s  %s\n' "$DOCKER_MACHINE_BINARY_SHA256" "$machine_binary" | sha256sum -c - >/dev/null
 printf '%s  %s\n' "$PACKET_DRIVER_BINARY_SHA256" "$packet_binary" | sha256sum -c - >/dev/null

scripts/prepare-sources

@@ -138,6 +138,10 @@ patch --batch --forward --fuzz=0 --reject-file=- \
   -d "$destination/source" -p1 <"$repo_root/patches/docker-machine-grpc-security.patch"
 patch --batch --forward --fuzz=0 --reject-file=- \
   -d "$destination/packet-source" -p1 <"$repo_root/patches/packet-driver-http2.patch"
+patch --batch --forward --fuzz=0 --reject-file=- \
+  -d "$destination/source" -p1 <"$repo_root/patches/docker-machine-xnet062.patch"
+patch --batch --forward --fuzz=0 --reject-file=- \
+  -d "$destination/packet-source" -p1 <"$repo_root/patches/packet-driver-xnet062.patch"
 
 printf '%s  %s\n' "$DOCKER_MACHINE_LICENSE_SHA256" \
   "$destination/source/LICENSE" | sha256sum -c - >/dev/null

scripts/validate

@@ -73,6 +73,12 @@ text = open(packet_patch, encoding="utf-8").read()
 files = re.findall(r"^diff --git a/(\S+) b/(\S+)$", text, re.MULTILINE)
 assert files, packet_patch
 assert all(left in {"go.mod", "go.sum"} and right == left for left, right in files), packet_patch
+
+for name in ("docker-machine-xnet062.patch", "packet-driver-xnet062.patch"):
+    path = __import__("pathlib").Path(machine_patch).with_name(name)
+    text = path.read_text(encoding="utf-8")
+    files = re.findall(r"^diff --git a/(\S+) b/(\S+)$", text, re.MULTILINE)
+    assert files and all(left in {"go.mod", "go.sum"} and right == left for left, right in files), path
 PY
 
 python3 - "$repo_root/scripts/collect-licenses.py" <<'PY'

scripts/verify-govulncheck.py

@@ -9,14 +9,14 @@
 from typing import Any
 
 
-CRYPTO_PURL = "pkg:golang/golang.org/x/crypto@v0.57.0"
+CRYPTO_PURL = "pkg:golang/golang.org/x/crypto@v0.58.0"
 
 EXPECTED_VEX = {
     ("GO-2026-5932", CRYPTO_PURL),
 }
 
 EXPECTED_MODULE_ONLY = {
-    ("GO-2026-5932", "golang.org/x/crypto", "v0.57.0"),
+    ("GO-2026-5932", "golang.org/x/crypto", "v0.58.0"),
 }
 
 

security/openvex.json

@@ -1,13 +1,19 @@
 {
   "@context": "https://openvex.dev/ns/v0.2.0",
-  "@id": "https://github.com/PastureStack/machine-driver-bundle/security/openvex/0.16.5",
+  "@id": "https://github.com/PastureStack/machine-driver-bundle/security/openvex/0.16.6",
   "author": "PastureStack Security",
-  "timestamp": "2026-08-25T08:00:00Z",
-  "version": 1,
+  "timestamp": "2026-10-29T10:37:19.322581+00:00",
+  "version": 2,
   "statements": [
     {
-      "vulnerability": {"name": "GO-2026-5932"},
-      "products": [{"@id": "pkg:golang/golang.org/x/crypto@v0.57.0"}],
+      "vulnerability": {
+        "name": "GO-2026-5932"
+      },
+      "products": [
+        {
+          "@id": "pkg:golang/golang.org/x/crypto@v0.58.0"
+        }
+      ],
       "status": "not_affected",
       "justification": "vulnerable_code_not_present",
       "impact_statement": "Source-mode govulncheck reports no reachable package or function, and neither command imports the unmaintained OpenPGP package."